I85PREP
⌘ K
Cambridge SC study materials
Cambridge SC study resources

Cambridge SC practice questions

One question at a time. Build your Cambridge SC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security fundamentals and threat landscape

In the CIA triad, which property is directly compromised when an attacker alters the amount on a bank transfer record?

  1. Non-repudiation
  2. Confidentiality
  3. Availability
  4. Integrity Correct answer.

Explanation

Integrity concerns the accuracy and completeness of data and the correctness of its processing. Unauthorized modification of a stored value such as a transfer amount is the textbook integrity violation, regardless of whether the attacker also read the data.

Question 2Security fundamentals and threat landscape

A phishing email spoofs the display name of a company's finance director but uses an unrelated external sending domain. Which control most directly detects this spoofing attempt at the mail gateway?

  1. A host-based antivirus signature update on the mail server
  2. Full-disk encryption on the recipient's laptop
  3. Sender Policy Framework and DMARC alignment checks on the envelope and header domains Correct answer.
  4. Mandatory password rotation every thirty days for all staff

Explanation

SPF authorizes sending IP addresses for a domain, while DMARC requires alignment between the visible From domain and an SPF or DKIM-authenticated domain. Together they let a gateway flag a message whose display name claims an internal executive but whose domain fails alignment.

Question 3Security fundamentals and threat landscape

Which term describes the practice of searching publicly available sources to gather information about an organization before an attack?

  1. Pivoting
  2. Open-source intelligence gathering Correct answer.
  3. Lateral movement
  4. Privilege escalation

Explanation

Open-source intelligence gathering, often called OSINT, uses public sources such as websites, social media, and public records to build a target profile during reconnaissance. The other terms describe post-compromise actions taken inside a network.

Question 4Security fundamentals and threat landscape

An attacker leaves a USB drive labelled 'Payroll 2025' in a staff car park, hoping an employee will plug it in. Which social engineering principle does this exploit most directly?

  1. Curiosity and the offer of something valuable Correct answer.
  2. Authority
  3. Scarcity
  4. Social proof

Explanation

Baiting relies on tempting a target with something they want, such as a file that appears relevant to their work. The label creates curiosity and perceived value, which is the core lever of a baiting attack.

Question 5Security fundamentals and threat landscape

Which malware characteristic best distinguishes a worm from a virus?

  1. A worm hides inside the boot sector of a disk
  2. A worm only executes when a user opens an infected document
  3. A worm self-propagates across networks without needing a host file or user action Correct answer.
  4. A worm encrypts files and demands payment

Explanation

A worm spreads autonomously by exploiting network services or weak credentials, whereas a virus requires a host file and typically a user action to execute and replicate. This autonomous propagation is the defining difference.

Question 6Security fundamentals and threat landscape

An analyst sees a process spawning from a word-processing application and immediately making outbound connections to an unfamiliar IP address. Which threat type does this pattern most strongly suggest?

  1. A misconfigured firewall rule allowing inbound traffic
  2. A physical tailgating attempt at a secure door
  3. A malicious macro delivering a remote access trojan Correct answer.
  4. A denial-of-service flood against a public web server

Explanation

Office applications spawning child processes that initiate outbound network connections is a common signature of a document macro dropping and launching a remote access trojan. The behaviour chain, not a single event, points to this intrusion pattern.

Question 7Security fundamentals and threat landscape

Which cryptographic weakness makes the MD5 hash algorithm unsuitable for verifying file integrity against deliberate tampering?

  1. It uses a symmetric key that must be shared with the recipient
  2. Practical collision attacks allow two different inputs to produce the same digest Correct answer.
  3. It produces a digest that is too long to store efficiently
  4. It requires a certificate authority to issue a key pair

Explanation

MD5 has known practical collision attacks, so an adversary can craft two files with the same digest and substitute one for the other. Integrity verification therefore requires a collision-resistant hash such as SHA-256.

Question 8Security fundamentals and threat landscape

What is the primary purpose of a salt when storing user passwords?

  1. To ensure identical passwords produce different stored hashes and defeat precomputed tables Correct answer.
  2. To encrypt the password so it can be recovered by an administrator
  3. To shorten the hash output so storage costs are reduced
  4. To replace the need for a slow key-derivation function

Explanation

A unique random salt per password means two users with the same password store different hash values, which defeats rainbow tables and forces attackers to attack each hash separately. The salt is not secret and does not remove the need for a slow derivation function.

Question 9Security fundamentals and threat landscape

In a public key infrastructure, which key is used to verify a digital signature created by a sender?

  1. The sender's public key Correct answer.
  2. The sender's private key
  3. The recipient's private key
  4. The recipient's public key

Explanation

A sender signs with their private key, and any recipient verifies with the sender's corresponding public key. This asymmetry lets anyone check authenticity while only the holder of the private key can create the signature.

Question 10Security fundamentals and threat landscape

A web application accepts a numeric account identifier in a URL and returns records for any value supplied. Which vulnerability class does this represent?

  1. Insecure direct object reference Correct answer.
  2. Cross-site request forgery
  3. SQL injection
  4. Cross-site scripting

Explanation

Insecure direct object reference occurs when an application exposes an internal identifier and fails to check that the requester is authorized for that object. Changing the value to another account and receiving its data is the defining symptom.

Question 11Security fundamentals and threat landscape

Which condition is necessary for a cross-site request forgery attack against a web application to succeed?

  1. The victim holds a valid authenticated session and the application accepts state-changing requests without a per-request token Correct answer.
  2. The application must store passwords using a weak hash
  3. The attacker must know the victim's plaintext password
  4. The victim's browser must have JavaScript disabled

Explanation

CSRF abuses the browser's automatic inclusion of session credentials, so the victim must be logged in and the server must lack a mechanism such as an anti-CSRF token or strict origin check. The attacker never needs the password itself.

Question 12Security fundamentals and threat landscape

Which statement best describes the role of a DMZ in network architecture?

  1. It is a backup network used only during disaster recovery
  2. It is the segment where all employee workstations must be placed
  3. It is an encrypted tunnel between two remote sites
  4. It hosts internet-facing services in a segment separated from the internal network by filtering controls Correct answer.

Explanation

A demilitarized zone is a buffer segment holding externally reachable systems, with filtering between it and both the internet and the internal network. If a public-facing host is compromised, the segmentation limits onward access to internal assets.

Question 13Security fundamentals and threat landscape

A security team wants to reduce the blast radius if a single server is compromised. Which design choice best achieves this?

  1. Segmenting workloads into zones with least-privilege firewall rules between them Correct answer.
  2. Disabling host logging to reduce storage costs
  3. Placing all servers on one flat VLAN to simplify routing
  4. Granting all servers a shared administrator account for simpler management

Explanation

Segmentation combined with least-privilege inter-zone rules limits which systems a compromised host can reach, containing the incident. Flat networks and shared credentials both enlarge the reachable attack surface after compromise.

Question 14Security fundamentals and threat landscape

Which attack involves an adversary intercepting and potentially altering traffic between two parties who believe they are communicating directly?

  1. On-path attack Correct answer.
  2. Supply-chain attack
  3. Brute-force attack
  4. Watering-hole attack

Explanation

An on-path attack, formerly called man-in-the-middle, places the adversary between two endpoints so traffic passes through them and can be read or modified. Strong mutual authentication and encryption are the main mitigations.

Question 15Security fundamentals and threat landscape

A DNS response arrives containing an additional record that maps a bank's domain to an attacker-controlled address. Which threat does this illustrate?

  1. DNS tunnelling
  2. Typosquatting
  3. DNS cache poisoning Correct answer.
  4. Domain fronting

Explanation

Cache poisoning injects forged records into a resolver's cache so subsequent queries return the attacker's address. DNSSEC validation is the primary defence because it lets resolvers verify the authenticity of records.

Question 16Security fundamentals and threat landscape

Which control provides the strongest mitigation against a replay attack on an authentication protocol?

  1. Compressing the authentication messages before transmission
  2. Requiring users to change passwords every ninety days
  3. Including a server-generated nonce with a short validity window in the challenge Correct answer.
  4. Logging every authentication attempt to a central server

Explanation

A fresh server-generated nonce makes each challenge unique, so a captured response cannot be reused later. A short validity window further limits any opportunity to replay a message.

Question 17Security fundamentals and threat landscape

What is the defining characteristic of a zero-day vulnerability?

  1. It affects only systems that are disconnected from networks
  2. It is discovered only after a patch has been published
  3. It is exploited before the vendor has released a fix Correct answer.
  4. It can be exploited only by an insider with physical access

Explanation

A zero-day is a flaw for which no vendor remedy exists at the moment of exploitation, leaving defenders without a patch. The term refers to the defender's window of exposure, not to the attacker's identity or the system's connectivity.

Question 18Security fundamentals and threat landscape

An organization wants to prioritize patching based on exploitability rather than raw severity. Which data source best supports that decision?

  1. The vendor's marketing release notes for the product
  2. The average age of the organization's server hardware
  3. The number of lines of code in the affected application
  4. A catalogue of vulnerabilities known to be exploited in the wild, cross-referenced with asset exposure Correct answer.

Explanation

Prioritization should combine evidence of active exploitation with whether the vulnerable asset is actually exposed and business-critical. Known-exploited catalogues provide that exploitation evidence, which raw severity scores alone do not.

Question 19Security fundamentals and threat landscape

Which activity is part of threat modelling during secure design?

  1. Enumerating assets, trust boundaries, and plausible attacker goals before code is written Correct answer.
  2. Reviewing firewall logs for anomalies during an incident
  3. Running a port scan against production hosts after deployment
  4. Restoring data from backup after a ransomware event

Explanation

Threat modelling is a design-time activity that identifies assets, entry points, trust boundaries, and the threats that matter so controls can be built in early. The other options are operational or response activities performed later.

Question 20Security fundamentals and threat landscape

A ransomware incident encrypts file servers and the backups are stored on a share reachable with the same domain credentials. What is the most important lesson for resilience?

  1. Domain administrator accounts should be shared among the operations team
  2. Encryption should be disabled on file servers to speed recovery
  3. Backups should be isolated and protected by separate credentials so ransomware cannot reach them Correct answer.
  4. Backups should be stored on the same share to simplify restore procedures

Explanation

If backups are reachable with the compromised credentials, the attacker can destroy them and remove the recovery path. Isolation, separate credentials, and offline or immutable copies preserve the ability to restore.

Question 21Security fundamentals and threat landscape

Which statement about the principle of least privilege is correct?

  1. Least privilege requires that all accounts share a single role
  2. Users and processes should receive only the access needed for their current task, for the shortest necessary time Correct answer.
  3. Least privilege applies only to human users and never to service accounts
  4. All administrators should hold permanent global rights so incidents can be handled quickly

Explanation

Least privilege limits rights to what is required for the task and, ideally, only for as long as needed. It applies to people, services, and processes alike, and it reduces the damage a compromised identity can cause.

Question 22Security fundamentals and threat landscape

An attacker with valid but low-privileged credentials finds a service running as a highly privileged account and exploits it to gain administrative access. Which phase of the attack does this describe?

  1. Reconnaissance
  2. Weaponization
  3. Privilege escalation Correct answer.
  4. Exfiltration

Explanation

Privilege escalation is the step in which an intruder converts limited access into higher rights, often by abusing an over-privileged service. It typically follows initial access and precedes deeper lateral movement.

Question 23Security fundamentals and threat landscape

Which indicator most reliably suggests data exfiltration over a covert channel rather than normal administrative traffic?

  1. Occasional outbound DNS queries to the organization's own resolvers
  2. A single large inbound file transfer during a scheduled patch window
  3. Consistent outbound transfers of similar size to an external host at regular intervals outside business hours Correct answer.
  4. Periodic inbound connections from the backup server during the nightly job

Explanation

Regular, similarly sized outbound transfers to an external destination at unusual times fit beaconing and staged exfiltration patterns. Legitimate scheduled traffic tends to align with documented jobs and known internal endpoints.

Question 24Security fundamentals and threat landscape

What is the main security benefit of application allowlisting on endpoints?

  1. Only approved executables can run, blocking unapproved malware even if it is not yet signatured Correct answer.
  2. It encrypts all files written to the local disk
  3. It removes the need for user authentication on the endpoint
  4. It guarantees that approved applications contain no vulnerabilities

Explanation

Allowlisting inverts the default so that unapproved code cannot execute, which blocks novel malware that has no known signature. It does not make approved software vulnerability-free and does not replace authentication.

Question 25Security fundamentals and threat landscape

A user receives a call from someone claiming to be from IT support who asks them to read back a one-time code just sent to their phone. Which attack is being attempted?

  1. Directory traversal
  2. Multi-factor authentication code capture and relay Correct answer.
  3. SQL injection
  4. Cross-site scripting

Explanation

The caller is trying to obtain a live second factor so they can complete a login, a voice-phishing form of MFA code capture and relay. MFA fatigue requires repeated authentication requests, which are not described here.

Question 26Security fundamentals and threat landscape

Which security model enforces access decisions by comparing the classification label of a subject with the classification label of an object, so that a subject cannot read data above its own clearance?

  1. Biba, through its no-read-down property
  2. Brewer-Nash, through dynamically changing access classes
  3. Clark-Wilson, through well-formed transaction rules
  4. Bell-LaPadula, through its no-read-up property Correct answer.

Explanation

Bell-LaPadula is a confidentiality model whose simple security property (no-read-up) prevents a subject from reading objects classified above its clearance level. Biba is its integrity counterpart and reverses the direction of the restriction. Clark-Wilson and Brewer-Nash address integrity through transactions and conflict-of-interest separation, not label comparison for confidentiality.

Question 27Security fundamentals and threat landscape

An organisation classifies a compromised laptop as having high likelihood of re-exploitation and moderate business impact. Which risk treatment decision does a formal risk assessment most directly support in this case?

  1. Selecting a treatment such as remediation, transfer, or acceptance based on the assessed likelihood and impact Correct answer.
  2. Deleting the risk register entry once the device has been rebuilt
  3. Reducing the classification of the asset so the risk score falls
  4. Assigning the risk to the security team without documenting a decision

Explanation

Risk assessment pairs likelihood with impact to produce a rating, and that rating drives a documented treatment choice among mitigation, transfer, avoidance, or acceptance. The treatment must be recorded with an owner so it can be reviewed later. Removing records or reclassifying assets manipulates the score without changing the underlying exposure.

Question 28Security fundamentals and threat landscape

A developer embeds a database connection string containing a plaintext password inside a compiled mobile application. Which weakness does this most directly represent, and what is the appropriate remediation?

  1. Missing output encoding, remediated by contextual escaping of rendered values
  2. Insufficient input validation, remediated by adding server-side schema checks
  3. Weak transport encryption, remediated by enforcing TLS with strong cipher suites
  4. Hard-coded secrets in the client, remediated by moving credentials server-side and issuing short-lived tokens Correct answer.

Explanation

Secrets embedded in a distributed client can be extracted by anyone who obtains the binary, so credentials must never ship with the app. The fix is to keep secrets on a trusted server and have the client request scoped, short-lived tokens. Input validation, transport encryption, and output encoding address different vulnerability classes and do not protect an extracted secret.

Question 29Security fundamentals and threat landscape

Which statement correctly distinguishes a vulnerability from an exploit?

  1. A vulnerability is an active attack, while an exploit is the resulting data breach
  2. A vulnerability is a monitoring gap, while an exploit is the alert generated by that gap
  3. A vulnerability is malicious code, while an exploit is the patch that removes it
  4. A vulnerability is a weakness that could be exploited, while an exploit is the technique or code that takes advantage of it Correct answer.

Explanation

A vulnerability is a flaw or weakness in a system, and an exploit is the means by which an attacker leverages that weakness. The two are distinct because a vulnerability can exist without any exploit being used against it. Patches, breaches, and alerts are separate concepts in the incident lifecycle.

Question 30Security fundamentals and threat landscape

An attacker registers a lookalike domain that differs from a supplier's domain by a single transposed character, then emails finance staff from that domain requesting a change of bank details. Which two controls together best reduce the likelihood of a successful payment?

  1. Endpoint antivirus scanning of attachments and quarterly security awareness training
  2. Network segmentation of the finance subnet and full-disk encryption on finance workstations
  3. DMARC enforcement on inbound mail and automatic forwarding of supplier invoices to a shared mailbox
  4. Callback verification to a known contact number and out-of-band confirmation of bank detail changes Correct answer.

Explanation

The attack combines a homoglyph or typo-squatting domain with a business email compromise pretext, so the decisive control is verifying the change through a channel the attacker does not control. Calling a previously known number and requiring dual authorisation for bank detail changes defeats the pretext. The other options may add defence in depth but do not verify the request itself.

Question 31Access control and authentication

In a discretionary access control (DAC) model, who ultimately decides which subjects may access a resource?

  1. The resource owner, who sets permissions at their discretion Correct answer.
  2. The network firewall, which filters each request
  3. The operating system kernel, which ignores ownership
  4. A central security administrator applying a site-wide policy

Explanation

DAC is defined by the resource owner holding the authority to grant or revoke access at their own discretion. This contrasts with mandatory models where a central authority imposes policy that owners cannot override.

Question 32Access control and authentication

Which statement best describes how mandatory access control (MAC) differs from discretionary access control?

  1. Permissions are stored only in access control lists attached to files
  2. Users are grouped into roles that map to job functions
  3. Subjects cannot override the system-wide policy labels that govern access Correct answer.
  4. Access decisions are made by the resource owner at their discretion

Explanation

In MAC, a system-wide policy based on security labels constrains access, and individual users cannot loosen it. The defining property is that policy enforcement is mandatory and outside owner discretion.

Question 33Access control and authentication

A file's access control entry grants read to group 'auditors' and the account is also a member of 'staff', which has no entry on the file. Under standard ACL evaluation, what access does the account receive?

  1. No access, because the staff group has no entry
  2. Read access only if the account is the file owner
  3. Read access, because the matching group entry grants it Correct answer.
  4. No access, because group entries are ignored

Explanation

ACL evaluation checks each entry and grants access when any applicable entry matches the subject's identity or group membership. The absence of a staff entry does not remove the grant that the auditors entry provides.

Question 34Access control and authentication

Which access control model assigns permissions to roles rather than directly to individual users, with users acquiring permissions through role membership?

  1. Mandatory access control (MAC)
  2. Rule-based access control with static labels
  3. Role-based access control (RBAC) Correct answer.
  4. Discretionary access control (DAC)

Explanation

RBAC centralises permissions on roles and assigns users to roles, simplifying administration and supporting least privilege. Permissions follow the role rather than the individual account.

Question 35Access control and authentication

An organisation wants to enforce least privilege so that a user who is temporarily covering a manager's duties gains the extra permissions only for that period. Which mechanism best supports this?

  1. Adding the user to the manager's group permanently
  2. Permanent assignment of the manager role to the user
  3. Time-bound activation of a role the user is eligible for Correct answer.
  4. Sharing the manager's credentials during the cover period

Explanation

Time-bound role activation grants elevated permissions only for the needed window and then expires, directly supporting least privilege and separation of duties. Permanent assignment or credential sharing leaves excess access in place.

Question 36Access control and authentication

What is the primary security weakness of relying on a single password as the only authentication factor?

  1. It requires more server storage than multifactor methods
  2. It is incompatible with hashed storage
  3. Compromise of the one secret grants access with no second barrier Correct answer.
  4. It cannot be combined with account lockout policies

Explanation

A single factor means one compromised secret is sufficient for access, with no independent evidence required. Multifactor authentication adds a second, different factor so a stolen password alone is insufficient.

Question 37Access control and authentication

Which combination correctly represents multifactor authentication?

  1. A password plus a one-time code from an authenticator app Correct answer.
  2. A password plus a remembered security question
  3. Two different passwords entered in sequence
  4. A password plus a username

Explanation

Multifactor authentication requires factors from different categories, such as something you know (password) and something you have (a code-generating device). The authenticator app supplies a possession-based factor distinct from the password.

Question 38Access control and authentication

In a Kerberos environment, what is the role of the ticket-granting ticket (TGT)?

  1. It lets the client request service tickets without resending the password Correct answer.
  2. It stores the user's password hash for offline verification
  3. It encrypts all application payloads between client and server
  4. It replaces the need for a key distribution centre

Explanation

The TGT is issued after initial authentication and is presented to the ticket-granting service to obtain service tickets. This avoids repeatedly transmitting the user's credentials across the network.

Question 39Access control and authentication

Why is a salt applied to a password before hashing and storage?

  1. It ensures identical passwords produce different stored hashes Correct answer.
  2. It encrypts the password so it can be recovered later
  3. It replaces the need for a password policy
  4. It shortens the hash to save storage space

Explanation

A unique salt per password makes identical passwords hash differently, defeating precomputed rainbow tables and hiding duplicate-password patterns. The salt is stored alongside the hash and need not be secret.

Question 40Access control and authentication

A system enforces account lockout after five failed login attempts. Which attack does this most directly mitigate?

  1. Online brute-force guessing against a live login service Correct answer.
  2. Phishing of credentials through a fake login page
  3. Offline cracking of a stolen password hash file
  4. Passive eavesdropping on an unencrypted session

Explanation

Lockout throttles repeated online attempts against the authentication service, making brute-force guessing impractical. It does nothing against offline cracking or social-engineering attacks.

Question 41Access control and authentication

Which practice best limits the damage if an attacker obtains a session token?

  1. Log the token value in plaintext for debugging
  2. Store the token in a long-lived cookie with no expiry
  3. Rely on the token being unguessable as the only control
  4. Set short session timeouts and bind tokens to context such as IP or device Correct answer.

Explanation

Short lifetimes and context binding reduce the window and conditions under which a stolen token is usable. These controls limit exposure even when token secrecy fails.

Question 42Access control and authentication

What distinguishes identification from authentication in an access control system?

  1. Identification encrypts traffic; authentication decrypts it
  2. Identification grants permissions; authentication logs the event
  3. Identification verifies a password; authentication assigns a username
  4. Identification claims an identity; authentication verifies that claim Correct answer.

Explanation

Identification is the act of presenting an identity such as a username, while authentication establishes that the claimed identity is genuine. Authorization then determines what the authenticated identity may do.

Question 43Access control and authentication

A user authenticates successfully but is denied access to a payroll folder. Which concept explains this outcome?

  1. Authorization determines permitted actions after authentication succeeds Correct answer.
  2. Authentication failed silently and should be retried
  3. The session token must have been forged by an attacker
  4. The account lockout threshold has been reached

Explanation

Authentication confirms identity, while authorization decides which resources that identity may use. A valid login with a denial indicates the authorization policy does not permit that access.

Question 44Access control and authentication

Which is an example of a possession-based authentication factor?

  1. A fingerprint the user presents
  2. A hardware security key the user physically holds Correct answer.
  3. A passphrase the user memorises
  4. A location the user is connecting from

Explanation

Possession factors are physical items the user has, such as a hardware token or security key. Memorised secrets are knowledge factors, and biometrics are inherence factors.

Question 45Access control and authentication

A web application accepts a numeric user ID in a URL and returns that user's records without checking ownership. Which vulnerability does this illustrate?

  1. Session fixation forcing a known session identifier
  2. Cross-site scripting enabling script injection
  3. SQL injection through unsanitised query strings
  4. Insecure direct object reference allowing horizontal privilege escalation Correct answer.

Explanation

When an application exposes internal object identifiers and fails to verify that the requester owns the object, users can access others' records at the same privilege level. This is insecure direct object reference and enables horizontal privilege escalation.

Question 46Access control and authentication

Which control most directly prevents a user from tampering with a hidden form field that carries their privilege level?

  1. Obfuscate the field name in the HTML source
  2. Re-derive privileges server-side from the authenticated session Correct answer.
  3. Disable the browser's developer tools through policy
  4. Add a longer random value to the hidden field

Explanation

Any value sent by the client is untrusted, so privilege must be determined on the server from the authenticated session. Client-side obfuscation or longer values do not stop tampering.

Question 47Access control and authentication

What is the purpose of a challenge-response authentication protocol?

  1. The client sends the password twice to confirm accuracy
  2. The server sends a challenge the client proves knowledge of without sending the secret Correct answer.
  3. The server stores the password in plaintext for comparison
  4. The client disables encryption to speed up login

Explanation

Challenge-response lets a client demonstrate possession of a secret by computing a response to a server-issued challenge, so the secret itself is not transmitted. This reduces exposure to eavesdropping and replay.

Question 48Access control and authentication

Which statement about the principle of least privilege in access control is correct?

  1. All users share a single administrative account for convenience
  2. Access rights are never reviewed once assigned
  3. Subjects receive only the access needed for their tasks and no more Correct answer.
  4. Permissions are granted broadly and revoked only after incidents

Explanation

Least privilege limits each subject to the minimum rights required to perform its function, reducing the blast radius of misuse or compromise. Regular review and timely revocation support this principle.

Question 49Access control and authentication

A company enforces separation of duties in its payment system. Which arrangement best implements this?

  1. One employee holds all payment permissions but is trusted
  2. One employee shares their approval credentials with a colleague
  3. One employee both creates and approves payments to save time
  4. One employee creates a payment and a different employee approves it Correct answer.

Explanation

Separation of duties splits a sensitive task so no single person controls the entire process, preventing fraud and error. Requiring a different person to approve a created payment enforces this split.

Question 50Access control and authentication

Which factor makes biometric authentication different from a password in terms of revocation?

  1. A biometric is easier to change than a passphrase
  2. A biometric can be reset by the helpdesk on request
  3. A compromised biometric trait cannot be reissued like a new password Correct answer.
  4. A biometric is stored as plaintext by design

Explanation

Biometric traits are physically bound to a person and cannot be replaced if compromised, unlike a password that can be changed. This limits biometrics as a sole factor and argues for liveness checks and template protection.