Week 2 Quiz 2 Security Principles

What is the principle that advocates for giving users and processes only the minimum privileges needed to perform their functions?

• Role-Based Access Control (RBAC)

• Fail-Safe Defaults

• Principle of Least Privilege (PoLP)

• Defense in Depth

According to the presentation, what is the core concept of "Fail-Safe Defaults"?

• Systems should be configured to be open by default.

• Users should be able to disable security features easily.

• Systems should default to a secure state when there's uncertainty or a failure.

• All traffic should be allowed unless a threat is detected.

Role-Based Access Control (RBAC) simplifies privilege management by assigning permissions based on what?

• Individual user names

• The time of day a user logs in

• A user's specific role within an organization

• The type of device a user is using

How does the Principle of Least Privilege (PoLP) help to reduce the attack surface of systems?

• By granting all users full access to all systems.

• By limiting the damage an attacker can cause if they compromise a low-privileged account.

• By allowing regular users to install software.

• By defaulting systems to an insecure state.

A company's new file server is configured to block all inbound and outbound network traffic by default. The administrator must then create specific rules to allow necessary services like HTTP and SSH. This configuration is an example of which secure design principle?

• Defense in Depth

• Principle of Least Privilege (PoLP)

• Role-Based Access Control (RBAC)

• Fail-Safe Defaults

A large corporation has different levels of employees: Admins, HR staff, and Finance Team members. The company uses a system that automatically grants access to specific files and applications based on these defined job functions. This approach is an effective implementation of which security concept?

• Fail-Safe Defaults

• Principle of Least Privilege (PoLP)

• Role-Based Access Control (RBAC)

• The MSR model

A software development team is creating a new application. They decide to design the application so that if a component fails, it will stop all operations until the issue is resolved, rather than continuing to run in a potentially vulnerable state. By adopting this approach, which security principle are they prioritizing?

• Role-Based Access Control (RBAC)

• Principle of Least Privilege (PoLP)

• Fail-Safe Defaults

• Defense in Depth

A junior data analyst is given access to a database. They are only allowed to view customer data for reporting purposes but are explicitly denied permissions to modify or delete any records. Which principle is being enforced in this scenario to reduce potential damage from accidental or malicious misuse?

• Fail-Safe Defaults

• Defense in Depth

• Principle of Least Privilege

• Role-Based Access Control

An organization is deciding between two security models. Model A grants every employee full access to all company data and systems by default, while Model B restricts all employee access by default, only granting specific permissions when a request is approved. Which model is more aligned with the principle of "Deny by default, permit by exception," and why is this model safer?

• Model A, because it allows for greater flexibility.

• Model B, because it aligns with Fail-Safe Defaults, preventing accidental exposure.

• Model A, because it eliminates the need for access requests.

• Model B, because it aligns with Defense in Depth, making it easier for users to access what they need.

A hospital's IT department is implementing new security protocols. They decide that a backup service should only have the permissions necessary to access and back up patient records, and nothing else. They also implement a policy that requires a nurse to manually enable file sharing on their computer each time they need it. How do these two actions collectively demonstrate the application of secure design principles?

• Both actions are examples of Defense in Depth, creating multiple layers of security.

• The backup service policy demonstrates the Principle of Least Privilege, while the file sharing policy demonstrates Fail-Safe Defaults.

• Both actions are examples of Role-Based Access Control, as they are based on user roles.

• The backup service policy demonstrates Fail-Safe Defaults, and the file sharing policy demonstrates the Principle of Least Privilege.