I85PREP
⌘ K
ICSP CS study materials
ICSP CS study resources

ICSP CS practice questions

One question at a time. Build your ICSP CS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Governance and Risk Management

In an ISMS aligned with ISO/IEC 27001, which document establishes the organization's overall intentions and direction for information security and provides the framework for setting security objectives?

  1. The asset inventory register
  2. The risk treatment plan
  3. The information security policy Correct answer.
  4. The statement of applicability

Explanation

The information security policy is the top-level management statement of intent and direction for security, and it provides the framework within which measurable objectives are set. Lower-level artifacts such as the statement of applicability and risk treatment plan operationalize that policy rather than define it.

Question 2Security Governance and Risk Management

A security manager needs a single metric to show senior leadership how much of the organization's identified risk exposure has been brought within tolerance. Which measure best fits that purpose?

  1. Count of security awareness emails distributed to staff
  2. Percentage of identified risks whose residual level is at or below the approved risk appetite Correct answer.
  3. Number of controls listed in the statement of applicability
  4. Total number of vulnerability scans completed during the quarter

Explanation

A risk-governance metric should reflect whether residual risk sits inside the tolerance the organization has formally accepted. Counting scans, emails, or listed controls measures activity volume rather than risk position, so it cannot demonstrate that exposure has been reduced to an acceptable level.

Question 3Security Governance and Risk Management

During risk assessment, a team rates a threat event as having low likelihood but catastrophic impact, and the organization's risk matrix treats impact as the dominant factor. What is the most appropriate governance response?

  1. Remove the risk from the register to avoid distorting aggregate reporting
  2. Defer assessment until the next annual review cycle
  3. Accept the risk without documentation because likelihood is low
  4. Escalate the risk for senior management decision because it exceeds the team's authority threshold Correct answer.

Explanation

When a risk's impact dominates the rating and pushes it beyond the delegated authority threshold, governance requires escalation to the level empowered to accept or fund treatment. Low likelihood does not justify undocumented acceptance, and deleting or deferring the entry would hide a significant exposure from decision-makers.

Question 4Security Governance and Risk Management

What is the primary purpose of the statement of applicability in an ISO/IEC 27001 ISMS?

  1. To list every information asset and its assigned owner
  2. To identify the controls that are necessary and justify inclusion or exclusion of each Annex A control Correct answer.
  3. To record the results of internal audit nonconformities
  4. To define the organization's risk acceptance criteria

Explanation

The statement of applicability documents which Annex A controls are applied and provides justification for any that are excluded. This makes control selection traceable to the risk assessment and treatment process.

Question 5Security Governance and Risk Management

An organization classifies information into Public, Internal, Confidential, and Restricted. Which governance element most directly ensures the classification scheme is applied consistently across business units?

  1. A backup schedule that runs nightly for all servers
  2. A vendor questionnaire sent to third parties before contracting
  3. A firewall rule set that blocks outbound traffic by destination
  4. A documented classification policy with defined criteria, labeling rules, and handling requirements per level Correct answer.

Explanation

Consistent classification depends on a documented policy that defines each level, the criteria for assigning it, how information is labeled, and what handling each level requires. Technical controls such as firewalls or backups do not determine classification decisions.

Question 6Security Governance and Risk Management

In risk terminology, what distinguishes a vulnerability from a threat?

  1. A vulnerability is a measured impact, while a threat is a calculated likelihood
  2. A vulnerability is an external attacker, while a threat is an internal control gap
  3. A vulnerability is a legal obligation, while a threat is a contractual penalty
  4. A vulnerability is a weakness that a threat could exploit, while a threat is a potential cause of an unwanted incident Correct answer.

Explanation

A vulnerability is an inherent weakness in an asset, process, or control that a threat source could exploit. A threat is a potential cause of an incident, such as an adversary, environmental event, or error, so the two are distinct inputs to risk.

Question 7Security Governance and Risk Management

A critical supplier suffers a breach that exposes the organization's customer data. Which governance action should occur first under a third-party risk management program?

  1. Remove the supplier from the approved vendor list and take no further action
  2. Activate the incident response and supplier notification process to assess exposure and contractual obligations Correct answer.
  3. Immediately terminate the supplier contract without assessing operational dependencies
  4. Wait for the supplier to publish a public post-incident report before acting

Explanation

Third-party incidents should trigger the organization's incident response and supplier notification procedures so exposure, notification duties, and contractual remedies can be assessed promptly. Unilateral termination or passive waiting can worsen the impact and breach obligations.

Question 8Security Governance and Risk Management

Which activity best demonstrates that an ISMS is operating with continual improvement rather than existing only on paper?

  1. Purchasing a SIEM platform and deploying it
  2. Tracking corrective actions from internal audits and management reviews through to verified closure Correct answer.
  3. Publishing an organizational chart of the security team
  4. Storing the information security policy in a shared drive

Explanation

Continual improvement is evidenced by a closed-loop process in which audit findings and management review outputs generate corrective actions that are tracked and verified as effective. Mere documentation, org charts, or tool purchases show inputs, not improvement outcomes.

Question 9Security Governance and Risk Management

What is the role of a risk owner in a security governance program?

  1. To approve the organization's overall risk appetite statement
  2. To independently audit the risk register for accuracy each quarter
  3. To make decisions about and be accountable for treating an assigned risk within their authority Correct answer.
  4. To perform all technical remediation tasks personally for every identified risk

Explanation

A risk owner is accountable for a specific risk and has the authority to decide on and monitor its treatment. This accountability is distinct from performing remediation work, auditing the register, or setting enterprise-wide appetite, which sits with top management.

Question 10Security Governance and Risk Management

A company adopts a risk matrix with five likelihood and five impact levels. Two analysts rate the same risk differently, one as medium and one as high. Which governance improvement most directly reduces this inconsistency?

  1. Adding more colors to the risk matrix heat map
  2. Increasing the frequency of risk register reviews
  3. Assigning the register to a single analyst permanently
  4. Defining explicit rating criteria and descriptors for each likelihood and impact level Correct answer.

Explanation

Inconsistent ratings usually stem from vague scales, so the durable fix is to define observable criteria and descriptors for every likelihood and impact level. This gives analysts a shared reference and makes ratings comparable and defensible.

Question 11Security Governance and Risk Management

Which statement correctly describes the relationship between risk appetite and risk tolerance?

  1. Risk appetite and tolerance are identical terms with no practical distinction
  2. Risk appetite is the amount of risk the organization is willing to pursue, while tolerance is the acceptable variation around that level Correct answer.
  3. Risk appetite applies only to financial risk, while tolerance applies only to security risk
  4. Risk appetite is set by operational teams, while tolerance is set by external regulators

Explanation

Risk appetite expresses the broad amount and type of risk an organization is willing to accept in pursuit of objectives. Risk tolerance defines the acceptable deviation or boundary around that appetite for specific activities, making it the more operational of the two.

Question 12Security Governance and Risk Management

An auditor finds that a control designed to review privileged access monthly has no evidence of execution for six months. How should this be classified in governance reporting?

  1. A control operating effectiveness deficiency requiring corrective action Correct answer.
  2. A compensating control that offsets the gap
  3. A risk acceptance decision by the control owner
  4. A residual risk that is automatically within appetite

Explanation

A control that is designed but not performed is not operating effectively, which is a deficiency requiring documented corrective action and follow-up. It is not an acceptance decision, does not automatically fall within appetite, and is not itself a compensating control.

Question 13Security Governance and Risk Management

Which of the following is the best example of a preventive security control in a governance context?

  1. A post-incident lessons-learned workshop
  2. A log review performed after suspicious activity is detected
  3. A monthly report summarizing past security incidents
  4. A mandatory access approval workflow enforced before privileged accounts are provisioned Correct answer.

Explanation

Preventive controls stop an event before it occurs, and a mandatory approval workflow enforced prior to provisioning does exactly that. The other options are detective or corrective activities that operate after an event or rely on hindsight.

Question 14Security Governance and Risk Management

A regulator requires the organization to demonstrate due care over personal data. Which combination best evidences due care to an auditor?

  1. Documented policies, implemented controls, and records showing both are monitored and enforced Correct answer.
  2. A plan to implement controls in a future fiscal year
  3. A signed executive statement with no supporting operational evidence
  4. A verbal assurance from the security manager during the audit interview

Explanation

Due care is demonstrated by showing that reasonable safeguards were not only defined but implemented and monitored, with records to prove it. Assertions, verbal assurances, and future plans lack the operational evidence an auditor needs.

Question 15Security Governance and Risk Management

In a business impact analysis, what does the recovery time objective (RTO) represent?

  1. The maximum acceptable time to restore a process or system after disruption Correct answer.
  2. The scheduled interval between backup jobs
  3. The duration of the annual disaster recovery test
  4. The maximum tolerable data loss measured in time before the disruption

Explanation

The RTO defines the target time within which a process or system must be restored to avoid unacceptable impact. It is distinct from the recovery point objective, which concerns tolerable data loss, and from operational schedules such as backup intervals.

Question 16Security Governance and Risk Management

A risk assessment identifies that a legacy application cannot be patched and its vendor support has ended. Which treatment option is being applied if the organization decides to keep running it while isolating it on a segmented network with enhanced monitoring?

  1. Risk avoidance by discontinuing the activity
  2. Risk retention with no further action
  3. Risk modification through additional compensating controls Correct answer.
  4. Risk sharing through contractual transfer

Explanation

Isolating the system and adding monitoring changes the risk by introducing compensating controls, which is risk modification. The activity continues, so it is not avoidance, and the added safeguards mean it is not unmitigated retention or transfer.

Question 17Security Governance and Risk Management

Why does segregation of duties function as a governance control rather than merely an operational convenience?

  1. It eliminates the need for independent audit of that process
  2. It guarantees that no errors will ever occur in a financial process
  3. It reduces the chance that a single person can both perpetrate and conceal an error or fraud Correct answer.
  4. It transfers accountability for the process to the security team

Explanation

Segregation of duties is a governance control because it distributes conflicting responsibilities so that no individual can initiate, approve, and conceal a transaction alone. It reduces risk but cannot guarantee error-free processes or replace independent audit.

Question 18Security Governance and Risk Management

Which artifact typically records the organization's chosen risk methodology, including scales, criteria, and the process for treating risks?

  1. The configuration baseline
  2. The risk management framework or methodology document Correct answer.
  3. The acceptable use policy
  4. The incident response plan

Explanation

The risk management framework or methodology document defines how risk is identified, analyzed, evaluated, and treated, including the scales and criteria used. Incident response plans, acceptable use policies, and configuration baselines address different governance needs.

Question 19Security Governance and Risk Management

An organization wants to benchmark its security program against a recognized international standard and obtain independent certification. Which approach is most appropriate?

  1. Rely on customer audits of individual projects as certification evidence
  2. Self-assess against a vendor security questionnaire and publish the results
  3. Adopt a control framework and declare conformance without external review
  4. Certify the ISMS against ISO/IEC 27001 through an accredited certification body Correct answer.

Explanation

Independent certification against ISO/IEC 27001 requires an accredited certification body to audit the ISMS. Self-assessment, unilateral declarations, and customer project audits do not constitute formal certification.

Question 20Security Governance and Risk Management

What is the main governance value of maintaining a risk register with owners, ratings, and treatment status?

  1. It guarantees that all identified risks will be eliminated
  2. It provides a traceable, prioritized record that supports consistent decisions and oversight Correct answer.
  3. It serves as the organization's legal contract with suppliers
  4. It replaces the need for management review meetings

Explanation

A risk register gives decision-makers a traceable and prioritized view of risks, owners, and treatment progress, which supports consistent oversight. It does not eliminate risk, substitute for management review, or function as a contract.

Question 21Security Governance and Risk Management

A new regulation imposes data localization requirements. Which sequence best reflects a sound governance response?

  1. Immediately migrate all data to a single local data center without impact analysis
  2. Delegate the entire obligation to the IT operations team without executive sponsorship
  3. Document an exception and take no action until the first enforcement notice
  4. Assess applicability and gaps, assign ownership, plan and fund remediation, then verify compliance Correct answer.

Explanation

Sound compliance governance starts with determining applicability and identifying gaps, then assigns ownership, funds and executes remediation, and verifies the result. Acting without analysis, abdicating sponsorship, or waiting for enforcement creates avoidable legal and operational risk.

Question 22Security Governance and Risk Management

Which term describes the risk that remains after controls have been applied and treatment decisions made?

  1. Inherent risk
  2. Residual risk Correct answer.
  3. Risk appetite
  4. Risk capacity

Explanation

Residual risk is what remains after existing controls and chosen treatments are applied. Inherent risk is the exposure before controls, while appetite and capacity describe willingness and ability to bear risk.

Question 23Security Governance and Risk Management

Senior management wants assurance that security spending is proportionate to the organization's risk profile. Which analysis best supports that decision?

  1. Comparing treatment costs against the reduction in residual risk for the highest-rated risks Correct answer.
  2. Benchmarking the number of security staff against industry averages
  3. Reviewing the length of the security policy document
  4. Counting the number of security tools deployed across the enterprise

Explanation

Proportionality is shown by weighing the cost of treatment against the risk reduction it delivers, especially for the highest-rated risks. Tool counts, policy length, and headcount comparisons measure inputs rather than the value of risk reduction.

Question 24Security Governance and Risk Management

In an ISMS, which role is responsible for ensuring that information security objectives are established at relevant functions and levels and are compatible with strategic direction?

  1. The internal audit function
  2. Top management Correct answer.
  3. Third-party service providers
  4. Individual control owners

Explanation

Top management is responsible for establishing security objectives that align with the organization's strategic direction and for integrating them across relevant functions and levels. Internal audit provides assurance, control owners execute controls, and providers deliver services.

Question 25Security Governance and Risk Management

A risk owner proposes accepting a high-rated risk because treatment is expensive. Which governance condition must be satisfied for that acceptance to be valid?

  1. The acceptance is revisited only if an incident actually occurs
  2. The risk is downgraded to low in the register to reflect the decision
  3. The risk owner verbally informs a colleague of the decision
  4. The acceptance is documented and approved by someone with authority above the risk owner's limit Correct answer.

Explanation

Accepting a high-rated risk requires documented approval at an authority level above the owner's delegated limit, so the decision is transparent and accountable. Verbal notice, re-rating the risk to justify acceptance, or waiting for an incident all undermine governance.

Question 26Security Governance and Risk Management

An organization is establishing an information security governance framework. Which document typically defines the organization's overall direction and intent for information security and is approved by executive management?

  1. Business continuity plan
  2. Risk treatment plan
  3. Information security policy Correct answer.
  4. Statement of Applicability

Explanation

The information security policy is a high-level document that sets the organization's direction and intent for security, and it requires executive approval to be effective. It provides the mandate for lower-level procedures and controls. Risk treatment plans, the Statement of Applicability, and business continuity plans are derived artifacts that support implementation rather than set overall direction.

Question 27Security Governance and Risk Management

An organization's risk register shows a high-severity risk related to unpatched internet-facing servers. The risk owner proposes to accept the risk because patching would disrupt a critical service. Which governance condition must be met before acceptance is legitimate?

  1. The acceptance must be documented and approved by a manager with authority above the risk owner's level. Correct answer.
  2. The acceptance must be kept informal to avoid creating a discoverable record.
  3. The risk must be transferred to an insurance provider before acceptance can be considered.
  4. The risk owner must personally accept all liability for any future incident.

Explanation

Risk acceptance is a formal governance decision that requires documented approval from an authority higher than the risk owner, ensuring accountability and alignment with risk appetite. Informal or undocumented acceptance undermines governance and auditability. Personal liability and mandatory insurance are not standard governance requirements for acceptance.

Question 28Security Governance and Risk Management

During a risk assessment, a team identifies that a third-party vendor has access to sensitive data but the contract lacks security requirements. Which risk treatment option is being applied if the organization decides to renegotiate the contract to include security clauses and audit rights?

  1. Risk mitigation Correct answer.
  2. Risk avoidance
  3. Risk transfer
  4. Risk acceptance

Explanation

Renegotiating a contract to add security clauses and audit rights reduces the likelihood or impact of a vendor-related incident, which is risk mitigation. Avoidance would mean eliminating the activity, transfer would shift financial consequences (e.g., insurance), and acceptance would involve no action.

Question 29Security Governance and Risk Management

An organization wants to ensure its security governance aligns with business objectives and that security investments are justified. Which approach best supports this alignment?

  1. Implementing a security awareness program and tracking completion rates.
  2. Conducting annual penetration tests and reporting the number of vulnerabilities found.
  3. Integrating security risk reporting into enterprise risk management and linking it to business impact analysis. Correct answer.
  4. Deploying a SIEM and monitoring alerts in real time.

Explanation

Aligning security governance with business objectives requires integrating security risks into the enterprise risk management framework and using business impact analysis to prioritize investments based on potential business harm. Technical activities such as penetration testing, awareness, and monitoring are important but do not by themselves demonstrate alignment with business objectives or justify investment levels.

Question 30Security Governance and Risk Management

Which term describes the process of comparing the organization's security controls and processes against a recognized standard to identify gaps and improve the security program?

  1. Auditing
  2. Certification
  3. Benchmarking Correct answer.
  4. Accreditation

Explanation

Benchmarking is the practice of comparing practices and controls against a standard or peer organizations to identify gaps and drive improvement. Certification is formal attestation by an external body, accreditation is formal approval by an authority, and auditing is an independent examination of evidence.

Question 31Access Control

In the context of access control, what does the principle of least privilege require?

  1. Access rights are granted based on the sensitivity label of the resource rather than the user's role
  2. Each subject is granted only the access rights necessary to perform its assigned task, for only as long as needed Correct answer.
  3. Every user is granted full administrative rights so that any task can be completed without delay
  4. All access decisions are logged and reviewed by an external auditor before being enforced

Explanation

Least privilege limits each subject to the minimum set of permissions required for its current function and duration. This reduces the attack surface and the blast radius of a compromised account. Granting broader rights or deferring enforcement to audit does not satisfy the principle.

Question 32Access Control

Which access control model bases decisions on comparing the clearance of a subject with the classification of an object, independent of the object owner's wishes?

  1. Role-based access control (RBAC)
  2. Discretionary access control (DAC)
  3. Mandatory access control (MAC) Correct answer.
  4. Rule-based access control

Explanation

In MAC the system enforces access using labels such as clearance and classification, and owners cannot override the policy. DAC instead lets the resource owner set permissions. RBAC derives rights from roles rather than labels.

Question 33Access Control

A file server stores permissions as an access control list. Which statement best describes how an ACL enforces access?

  1. It records each subject and the operations that subject may perform on the object Correct answer.
  2. It derives permissions dynamically from the subject's job title at query time
  3. It assigns every object a single classification level compared with user clearance
  4. It stores a secret key that each subject must present to decrypt the object

Explanation

An ACL is attached to an object and enumerates subjects together with the operations each is permitted. Enforcement is a lookup of the requesting subject in that list. Encryption keys, label comparison, and dynamic role derivation are different mechanisms.

Question 34Access Control

Which authentication factor category does a hardware token that generates a time-based one-time code belong to?

  1. Something you have Correct answer.
  2. Something you are
  3. Somewhere you are
  4. Something you know

Explanation

A hardware token is a physical object the user possesses, so it is a possession factor. Knowledge factors are memorized secrets, inherence factors are biometric traits, and location is a contextual attribute rather than a possession factor.

Question 35Access Control

Which practice most directly mitigates the risk of credential stuffing against a web login?

  1. Requiring multi-factor authentication for sign-in Correct answer.
  2. Enforcing a maximum password length of eight characters
  3. Storing passwords with a fast unsalted hash
  4. Publishing the password policy on the login page

Explanation

Credential stuffing replays breached username and password pairs, so a second independent factor blocks the attacker even when the password is correct. Limiting length, publishing policy, or using fast unsalted hashes does not stop replayed valid credentials and may worsen exposure.

Question 36Access Control

A company wants new employees to receive exactly the permissions of their job function and to lose them automatically when they transfer. Which approach best fits?

  1. Assign users to roles that carry the permissions of the job function Correct answer.
  2. Grant all employees a shared standard user account
  3. Assign each user individually crafted permissions on each resource
  4. Rely on file owners to remove access manually after each transfer

Explanation

Role-based access control ties permissions to roles reflecting job functions, so assignment and removal follow role membership changes. Per-user permissions and manual owner cleanup scale poorly and invite privilege creep, and shared accounts destroy accountability.

Question 37Access Control

During review of a Linux file, the permission string shows the owner with read and write, the group with read only, and others with no access. Which numeric mode corresponds to this setting?

  1. 604
  2. 644
  3. 640 Correct answer.
  4. 660

Explanation

Read is 4 and write is 2, so owner read plus write equals 6, group read equals 4, and others none equals 0, giving 640. The other values grant group write, others read, or both, which the described setting excludes.

Question 38Access Control

Why does the Bell-LaPadula model prohibit a subject from writing to an object at a lower classification?

  1. To allow users to declassify documents without approval
  2. To prevent high-classification information from flowing down to less protected objects Correct answer.
  3. To prevent a subject from reading data below its clearance level
  4. To ensure that every object has at least one owner who can change its label

Explanation

The star property, or no write down rule, blocks a subject from sending information to a less classified object, which prevents leakage of sensitive data. Reading below clearance is permitted by the simple security property, and declassification requires authorized processes, not unrestricted writes.

Question 39Access Control

An administrator must decide between a synchronous and an asynchronous authentication response. Which statement about federation protocols is accurate?

  1. SAML assertions are never signed and rely only on TLS for integrity
  2. OAuth 2.0 is an authentication protocol that directly asserts user identity to the client
  3. OpenID Connect cannot be layered on top of OAuth 2.0
  4. SAML 2.0 web browser single sign-on typically posts a signed assertion through the user's browser Correct answer.

Explanation

In the SAML web browser SSO profile the identity provider returns a signed assertion to the service provider via the browser, typically by HTTP POST. OAuth 2.0 is an authorization framework, and OpenID Connect is built on it to add authentication.

Question 40Access Control

Which control is an example of a preventive physical access control for a data center?

  1. A visitor log completed at the reception desk
  2. A badge reader that unlocks the door only for authorized staff Correct answer.
  3. A video recording system reviewed after an incident
  4. A motion alarm that alerts guards when someone enters

Explanation

A badge reader that releases the door only for authorized people stops unauthorized entry before it happens, which makes it preventive. Recording, alarming, and logging are detective or administrative controls because they observe or record events rather than block them.

Question 41Access Control

Which statement correctly distinguishes identification from authentication?

  1. Identification and authentication are synonyms in access control
  2. Identification proves a claimed identity, while authentication assigns a username
  3. Identification claims an identity, while authentication verifies that claim Correct answer.
  4. Authentication claims an identity, while authorization verifies the claim

Explanation

Identification is the act of presenting an identity such as a username or certificate subject, while authentication verifies that the presented identity is genuine. Authorization then determines what the authenticated subject may do.

Question 42Access Control

A security team wants to ensure that a dismissed employee's access ends immediately. Which control is most effective?

  1. A password complexity policy applied at the next login
  2. A quarterly access recertification campaign
  3. Automated account disablement triggered by the HR termination event Correct answer.
  4. Annual review of role definitions

Explanation

Automating disablement from the authoritative HR termination event removes access at the moment of the status change. Periodic recertification, password policy, and annual role review all operate on much slower cycles and leave a window of exposure.

Question 43Access Control

Which session management weakness allows an attacker to reuse a session identifier captured before the user authenticated?

  1. Session resumption
  2. Session timeout
  3. Session fixation Correct answer.
  4. Session affinity

Explanation

Session fixation occurs when an attacker plants or knows a session identifier and the application keeps using it after login, letting the attacker ride the authenticated session. The fix is to issue a fresh identifier at authentication. Timeouts, affinity, and resumption are not fixation attacks.

Question 44Access Control

A developer must store user passwords for verification. Which approach is appropriate?

  1. Store a fast hash such as unsalted SHA-256 of the password
  2. Store a salted, slow hash produced by a memory-hard algorithm such as Argon2id Correct answer.
  3. Store the password in plaintext inside a protected configuration file
  4. Encrypt each password with a single application-wide symmetric key

Explanation

Passwords should be stored as salted hashes from a deliberately slow, memory-hard algorithm so that offline guessing is expensive and precomputation is defeated. Reversible encryption, plaintext, and fast unsalted hashes all leave passwords recoverable or cheap to crack.

Question 45Access Control

In a Kerberos environment, what is the primary function of the ticket-granting ticket?

  1. It lets the client obtain service tickets from the ticket-granting service without resending the password Correct answer.
  2. It permanently replaces the need for any service ticket
  3. It stores the user's long-term password in plaintext for convenience
  4. It encrypts all user file data stored on the server

Explanation

After initial authentication the client receives a TGT, which it presents to the ticket-granting service to request service tickets. This avoids repeated transmission of the user's password and limits how often long-term credentials are used.

Question 46Access Control

Which scenario best illustrates the confused deputy problem in access control?

  1. A privileged service accepts a client-supplied file path and reads a file the client could not access itself Correct answer.
  2. An auditor reviews logs and finds a missing entry for a login event
  3. A user types the wrong password and is locked out after several attempts
  4. A server rejects a request because the client's TLS certificate has expired

Explanation

The confused deputy arises when a more privileged component is tricked into using its authority on behalf of a less privileged caller. Validating the caller's authorization and constraining inputs such as file paths prevents the abuse. The other options describe ordinary failures or detection gaps.

Question 47Access Control

Why is a default-deny posture preferred over a default-allow posture for firewall policy?

  1. It reduces the number of rules that must be written to zero
  2. It allows all outbound traffic while blocking only known malicious addresses
  3. It removes the need to log denied connection attempts
  4. It ensures only explicitly permitted traffic passes, so unanticipated services stay blocked Correct answer.

Explanation

Default deny blocks everything not explicitly allowed, so a new or forgotten service is not exposed by omission. Default allow depends on enumerating every bad case, which fails when threats are unknown. Logging denied traffic remains valuable under either posture.

Question 48Access Control

Which characteristic distinguishes attribute-based access control from role-based access control?

  1. ABAC forbids the use of environmental context such as time or location
  2. ABAC evaluates attributes of the subject, resource, action, and environment in its policy decisions Correct answer.
  3. ABAC requires that every user be assigned exactly one static role
  4. ABAC cannot express policies that depend on the resource being accessed

Explanation

ABAC policies combine attributes of the subject, resource, action, and environment, which allows fine-grained and context-aware decisions. RBAC centers on role membership. The other options misstate ABAC's flexibility.

Question 49Access Control

A web application lets users change their own password but exposes an endpoint that accepts any account identifier. Which flaw does this represent?

  1. Insufficient session entropy
  2. Horizontal privilege escalation Correct answer.
  3. Race condition in session handling
  4. Vertical privilege escalation

Explanation

Horizontal privilege escalation occurs when a user can act on resources belonging to another user at the same privilege level. Vertical escalation would involve gaining higher-level functions. The issue here is missing authorization checks on the object identifier.

Question 50Access Control

Which statement about the role of authorization in an API gateway is correct?

  1. The gateway should authenticate callers and enforce coarse-grained policy while services enforce resource-level rules Correct answer.
  2. The gateway should store user passwords to verify each request independently
  3. The gateway should disable logging of denied requests to reduce storage costs
  4. The gateway should trust any request that arrives over TLS and forward it without checks

Explanation

A gateway commonly terminates authentication and applies coarse policy such as allowed scopes or routes, while each service enforces fine-grained, resource-level authorization because only it understands its data. Trusting TLS alone or duplicating password storage creates gaps and risk.