Cybersecurity Principles and Practices

What is the primary goal of implementing "Defense in Depth" in cybersecurity?

• To rely on a single, strong security mechanism to protect a system.

• To create multiple layers of security to make it difficult for attackers to breach a system.

• To ensure that only authorized users can access the system.

• To quickly recover data after a successful cyberattack.

In a modern security architecture, which of the following is an example of applying the "Defense in Depth" principle?

• Using only a strong password for user authentication.

• Implementing multi-factor authentication (MFA), mobile device management (MDM), and endpoint detection and response (EDR) on user devices.

• Storing all data on a single, highly secure server.

• Allowing all network traffic to pass through without inspection.

The principle of "Least Privilege" in cybersecurity primarily dictates that users should:

• Be granted full administrative access to all systems.

• Only receive access rights that are absolutely necessary for their job functions and only for the required duration.

• Have their access rights automatically increase over time.

• Be able to access any system "just in case" they might need it.

When hardening a web server according to the principle of "Least Privilege," what action should be taken regarding unnecessary services like FTP or SSH if they are not being used?

• Keep them enabled but monitor them closely.

• Change their default ports to obscure them from attackers.

• Remove them entirely to reduce the attack surface.

• Configure them with very strong passwords.

Which action is part of hardening a system to improve security?

• Keeping default administrator IDs and passwords for easy access.

• Allowing all users to have full administrative privileges.

• Removing unnecessary user accounts and changing default credentials.

• Installing software without checking for known vulnerabilities.

What is a common pitfall that violates the principle of least privilege?

• Granting users only the necessary permissions for their current role.

• Regularly reviewing and revoking unnecessary access rights.

• Providing users with extra permissions they might need in the future, "just in case."

• Changing default administrator usernames and passwords.

What is the primary goal of implementing the principle of separation of duties in cybersecurity?

• To allow a single individual to manage all critical system functions.

• To simplify system administration by centralizing control.

• To prevent any single person from being able to compromise a system alone.

• To reduce the number of users who have access to any system.

When should security considerations be integrated into the development lifecycle of an IT system?

• Only after the system has been fully developed and is ready for production.

• Primarily during the testing phase to identify and fix vulnerabilities.

• From the initial requirements and design phases through to deployment and ongoing operation.

• As an optional add-on feature if time and budget allow.

What is the primary goal of implementing "Secure by Design" in a system?

• To add security features after the system is fully developed.

• To ensure security is an inherent part of the system from its initial conception.

• To make the system secure only when it is first installed.

• To allow users to configure security settings after deployment.

In the context of IT security, what does the KISS principle primarily advocate for?

• Creating highly complex security systems to deter attackers.

• Making security measures as simple and user-friendly as possible.

• Implementing security features that are secret and unknown to users.

• Prioritizing security over system usability and convenience.