General Security Concepts practice questions

Confidentiality

Why wrong: Confidentiality is concerned with preventing unauthorized disclosure of information. Hashing does not protect data from being read; it only verifies that the data has not been modified. Therefore, this option is incorrect.

Availability

Why wrong: Availability ensures that systems and data are accessible when needed. Hashing does not affect system uptime or accessibility, so it does not directly protect availability. This option is incorrect.

Authentication

Why wrong: Authentication verifies the identity of a user or system. Hashing configuration files does not confirm the identity of the entity making changes; it only indicates that a change occurred. Thus, this option is incorrect.

Defense in depth

Why wrong: Defense in depth refers to layering multiple security controls (e.g., firewalls, antivirus, encryption). While this policy adds a layer of control, its primary purpose is not layering but enforcing a division of authority.

Least privilege

Why wrong: Least privilege limits users to only the permissions they need to perform their job. This policy does not necessarily reduce permissions; it divides the steps required to make a change among multiple people.

Need to know

Why wrong: Need to know restricts access to sensitive data based on whether it is required for a specific job function. The described policy governs actions (approving and executing changes) rather than data access.

Least privilege

Why wrong: Least privilege restricts users and systems to only the permissions necessary to perform their functions. It does not address the layering of multiple independent security controls.

Zero trust

Why wrong: Zero trust is a security model that assumes no implicit trust and requires continuous verification for every access attempt. While it may involve multiple controls, its primary focus is on verifying each request, not on layering independent controls as described.

Separation of duties

Why wrong: Separation of duties divides critical tasks or privileges among multiple people to reduce the risk of fraud or error. The scenario does not involve splitting responsibilities among individuals.

Defense in depth

Why wrong: Defense in depth refers to the use of multiple, overlapping layers of security controls to protect assets. The scenario describes an access control misconfiguration, not a lack of layered defenses.

Non-repudiation

Why wrong: Non-repudiation ensures that a party cannot deny having performed an action, typically achieved through digital signatures or audit logs. The scenario does not involve denial of actions; it involves excessive permissions.

Availability

Why wrong: Availability ensures that systems and data are accessible when needed by authorized users. While excessive privileges might indirectly affect availability if misused, the direct violation in this case is that users have more permissions than necessary, which is a breach of least privilege.

Discretionary Access Control (DAC)

Why wrong: DAC allows the owner of a resource to set permissions. This would permit administrators to override clearance restrictions, which violates the policy's requirement.

Role-Based Access Control (RBAC)

Why wrong: RBAC assigns permissions based on job roles, not on clearance levels. It does not inherently enforce a mandatory policy based on classification labels, and administrators could modify role assignments.

Attribute-Based Access Control (ABAC)

Why wrong: ABAC evaluates attributes to make access decisions, but the policies are typically configurable by administrators. It does not provide the mandatory, non-overridable enforcement required by the clearance-based policy.

Confidentiality

Why wrong: Confidentiality is about preventing unauthorized access to data. The backup restoration does not address whether the data was exposed; it focuses on correcting unauthorized modifications.

Availability

Why wrong: Availability ensures systems and data are accessible when needed. While the restoration does make the correct data available again, the primary driver for the action is to fix the integrity violation, not to restore availability (which was not lost).

Non-repudiation

Why wrong: Non-repudiation provides proof of an action or event, such as a digital signature. Restoring from backup does not provide evidence of who performed the modifications; it only corrects the data.

Cryptographic hash

Why wrong: Incorrect. A cryptographic hash (e.g., SHA-256) ensures integrity but does not provide authentication. An attacker could replace the file and the hash simultaneously, so alone it does not prove the source.

Antivirus scan report

Why wrong: Incorrect. An antivirus scan report only indicates whether known malware is present. It does not cryptographically verify the file's origin or integrity.

TLS certificate

Why wrong: Incorrect. TLS protects data in transit between the website and the downloader, but it does not provide a persistent, verifiable property for the file itself after download. A TLS certificate authenticates the server, not the individual file.

Authorization

Why wrong: Authorization determines what resources a user can access and what actions they are allowed to perform. While important, it does not prevent a user from denying that they performed an authorized action.

Authentication

Why wrong: Authentication verifies the identity of a user (e.g., via passwords or biometrics). Although necessary for accountability, it does not by itself prevent a user from later denying specific actions.

Availability

Why wrong: Availability ensures that systems and data are accessible when needed. The described policy focuses on accountability and non-repudiation, not on uptime or resilience against denial-of-service.

Least privilege

Why wrong: Least privilege grants users only the permissions necessary to perform their job, but the policy here is about splitting tasks between individuals, not just minimizing permissions.

Defense in depth

Why wrong: Defense in depth involves multiple layers of security controls (e.g., firewall, antivirus, encryption), not the division of responsibilities within a process.

Mandatory access control

Why wrong: Mandatory access control relies on system-enforced labels and clearances, not on dividing functional roles.

Least privilege

Why wrong: This option is incorrect because the scenario does not describe minimizing user permissions; it focuses on layering different types of controls. Least privilege is about granting only the minimum necessary access rights, which is not the primary principle demonstrated here.

Separation of duties

Why wrong: This option is incorrect because separation of duties involves dividing critical tasks among multiple individuals to prevent fraud or error. The scenario does not mention any division of administrative responsibilities; it is about technical controls.

Fail safe

Why wrong: This option is incorrect because fail safe refers to a system defaulting to a secure state when a failure occurs (e.g., a door locking on power loss). The architect's approach does not specifically address failure modes but instead builds layered defenses.

Preventive control

Why wrong: Incorrect. Preventive controls are designed to stop security incidents before they occur, such as firewalls or access control lists. An IDS does not block traffic; it only monitors and alerts.

Corrective control

Why wrong: Incorrect. Corrective controls are implemented to remediate or recover from an incident (e.g., backup restoration, patching a vulnerability). An IDS does not take action to fix issues; it only detects them.

Deterrent control

Why wrong: Incorrect. Deterrent controls aim to discourage potential attackers (e.g., warning signs, security cameras). While an IDS can indirectly deter, its primary function is detection, not deterrence.

Procedure, because it always defines the highest-level mandatory rules.

Why wrong: Procedures describe step-by-step tasks for performing a process, but they are usually more detailed than a policy and not the highest-level rule set.

Guideline, because it provides optional suggestions for best behavior.

Why wrong: Guidelines offer recommended practices and flexibility, but they are not the best choice when the company wants mandatory requirements for everyone.

Standard, because it contains only optional advice about security.

Why wrong: Standards define specific mandatory details, such as settings or thresholds, but they do not usually serve as the main company-wide rule document.

Authentication

Why wrong: Authentication confirms identity, but it does not decide what the user can do.

Accounting

Why wrong: Accounting records actions and usage, but it does not grant or deny access.

Encryption

Why wrong: Encryption protects data confidentiality, but it is not an AAA function.

Hash the contract and email the hash value separately.

Why wrong: A hash can help detect tampering, but it does not provide confidentiality or prove authorship by itself.

Use a shared symmetric key and send the key in the same email message.

Why wrong: A shared key can encrypt data, but sending it in the same message defeats the protection and creates obvious exposure.

Compress the file and password-protect the archive with a simple passphrase.

Why wrong: Password protection is weaker than proper public key encryption and does not provide strong, verifiable origin assurance.

It proves a user is who they claim to be

Why wrong: That describes authentication, not authorization. Authentication verifies identity using something the user knows, has, or is, such as a password, token, or biometric factor; authorization comes later and decides what that authenticated identity can access.

It records every packet a device sends

Why wrong: Recording activity is part of accounting, logging, or monitoring, not authorization. Authorization is concerned with granting or denying access, while accounting tracks what actions were performed.

It replaces the need for authentication

Why wrong: Authorization cannot replace authentication because the system must first establish who the user is before it can apply permissions. Access control rules depend on an authenticated identity, such as a user account or service principal.

Preventive control

Why wrong: A preventive control stops the event, but the alarm activates after the issue begins.

Corrective control

Why wrong: A corrective control fixes a problem after it happens, but the alarm itself only reports the issue.

Deterrent control

Why wrong: A deterrent control discourages bad behavior, but an alarm primarily detects and announces a problem.

Store the same key in a password-protected ZIP archive on the backup server.

Why wrong: That still keeps a single reusable secret on the same system and does not reduce compromise impact meaningfully.

Replace AES with SHA-256 so the files cannot be opened directly.

Why wrong: SHA-256 is a hash function, not a reversible encryption method for protecting backup contents.

Keep one key forever and increase the backup frequency.

Why wrong: More backups do not reduce key exposure, and a permanent key increases long-term risk.

Increase the token lifetime so users reauthenticate less often.

Why wrong: Longer token lifetimes make stale authorization claims valid for even more time after role changes.

Move the application to a different subnet to isolate it from HR systems.

Why wrong: Network placement does not correct stale claims already issued to the user by the identity system.

Disable group-based authorization and let any authenticated user approve expenses.

Why wrong: Removing authorization checks would create a much larger access problem instead of fixing stale role data.

Require the shared account password to be changed every 24 hours.

Why wrong: Frequent password changes may reduce reuse, but they do not show which person performed each action.

Enable automatic account lockout after five failed logons.

Why wrong: Lockout helps against guessing attacks, but it does not solve shared-account traceability or accountability.

Restrict the jump host by MAC address and subnet only.

Why wrong: Network-based restrictions may reduce exposure, but they do not identify the individual using the account.

Block all internet access on finance laptops except for the accounting website.

Why wrong: This is far broader than needed and would disrupt normal work. The problem is removable-media copy risk, not general internet use.

Increase the password complexity requirements for finance users.

Why wrong: Stronger passwords do not address local data copying to USB drives. The data leaves through a physical channel, so authentication strength is not the primary issue.

Add more antivirus signatures to the endpoint protection platform.

Why wrong: Antivirus is useful against malware, but it does not stop legitimate users from copying sensitive reports to flash drives. The incident is a data-loss problem, not a malware-detection problem.