Security Fundamental

What is the purpose of a Non-Disclosure Agreement (NDA) during onboarding?

• To issue security tokens

• To provision user accounts

• To protect sensitive company information

• To assign default privileges

Answer explanation

The purpose of a Non-Disclosure Agreement (NDA) during onboarding is to protect sensitive company information. It ensures that new employees do not disclose confidential data, safeguarding the company's interests.

Which principle states that users should only be given permissions necessary to perform their job?

• Separation of duties

• Mandatory vacations

• Least privilege

• Role-based access

Answer explanation

The principle of 'Least privilege' ensures that users are granted only the permissions necessary to perform their job functions, minimizing potential security risks.

Which account is a key target for attackers and often disabled after system installation?

• Guest account

• Service account

• Standard user account

• Administrator/root account

Answer explanation

The Administrator/root account is a primary target for attackers due to its high-level access. It is often disabled after installation to enhance security and prevent unauthorized access.

Why are shared accounts discouraged in a secure environment?

• They are more expensive to maintain

• They break the principle of non-repudiation

• They offer better collaboration

• They improve password rotation

Answer explanation

Shared accounts compromise non-repudiation because it's unclear who performed an action, making accountability difficult. This undermines security protocols and can lead to unauthorized access or actions.

What is a major risk associated with generic device accounts?

• Network congestion

• They automatically log out users

• Default passwords may not be changed

• Incompatibility with MFA

Answer explanation

A major risk with generic device accounts is that default passwords may not be changed, leaving systems vulnerable to unauthorized access. This can lead to security breaches and data loss.

Which account type typically has limited privileges and cannot change system configuration?

• Standard user

• Guest user

• Service account

• Superuser

Answer explanation

A Standard user account typically has limited privileges, preventing it from changing system configurations. This contrasts with Superuser accounts, which have full access, and Guest or Service accounts, which have even more restrictions.

What is the purpose of job rotation policies?

• To enforce working hours

• To reduce dependency on one employee and distribute knowledge

• To increase salaries

• To simplify account provisioning

Answer explanation

Job rotation policies aim to reduce dependency on a single employee by encouraging knowledge sharing and skill development across the team. This enhances flexibility and ensures that critical tasks can be managed by multiple individuals.

What access control model is based on roles instead of individual user permissions?

• Discretionary Access Control (DAC)

• Role-Based Access Control (RBAC)

• Mandatory Access Control (MAC)

• Rule-Based Access Control

Answer explanation

Role-Based Access Control (RBAC) assigns permissions based on roles rather than individual users, making it easier to manage access rights in organizations. This model contrasts with DAC and MAC, which focus on user-specific or system-enforced permissions.

What protocol is commonly used for federated identity and supports XML assertions?

• SAML

• TLS

• OAuth

• LDAP

Answer explanation

SAML (Security Assertion Markup Language) is the protocol designed for federated identity management and uses XML to format assertions about user identities, making it the correct choice for this question.

What type of training might simulate phishing emails to test employee awareness?

• Clean desk audits

• CBT

• Phishing campaigns

• Bring your own device training

Answer explanation

Phishing campaigns are designed to simulate phishing emails, helping to test and improve employee awareness of such threats. This training method directly addresses the question's focus on phishing awareness.