Describe the concepts of security, compliance, and identity practice questions

Confidentiality

Why wrong: Confidentiality focuses on preventing unauthorized access or disclosure, not modification.

Availability

Why wrong: Availability ensures that systems and data are accessible when needed, but does not address modification.

Non-repudiation

Why wrong: Non-repudiation provides proof of origin or delivery of data, not protection against modification.

Patching the physical servers hosting the database

Why wrong: Physical server patching is the responsibility of the cloud provider (Microsoft) in a PaaS service like Azure SQL Database.

Securing the hypervisor running the virtual machines

Why wrong: Hypervisor security is provided by the cloud provider as part of the underlying infrastructure.

Hardening the network firewalls at the datacenter perimeter

Why wrong: Physical network security is the responsibility of the cloud provider.

Defense in Depth

Why wrong: This model layers multiple security controls but does not specifically require continuous verification of every request. It assumes multiple layers of defense.

Least Privilege

Why wrong: This principle grants only the minimum permissions needed, but it is a component of security models, not the overarching model described.

Shared Responsibility

Why wrong: This is a model defining responsibilities between cloud provider and customer, not the authentication/access validation model described.

Software as a Service (SaaS)

Why wrong: In SaaS, the provider manages most of the security stack (application, data, runtime, etc.), leaving the customer mainly responsible for data classification and user access. This is the least customer responsibility.

Platform as a Service (PaaS)

Why wrong: The provider manages the runtime, middleware, OS, and infrastructure; the customer is responsible for their applications and data. Customer responsibility is moderate, less than IaaS.

On-premises

Why wrong: On-premises is not a cloud service model. In an on-premises environment, all security is the customer's responsibility, but the question specifically asks about cloud service models.

Network segmentation

Why wrong: Incorrect. While network segmentation is a technique used to support the 'Assume breach' principle, it is not one of the three core guiding principles of Zero Trust.

Integrity

Why wrong: Integrity focuses on preventing unauthorized modifications, not on restricting access to authorized parties.

Availability

Why wrong: Availability ensures that systems and data are accessible when needed, not specifically that access is limited to authorized users.

Non-repudiation

Why wrong: Non-repudiation provides assurance that a user cannot deny an action, often through digital signatures, but does not govern access control.

Dynamic groups

Why wrong: Dynamic groups automatically add or remove members based on rules but do not delegate administrative scopes to specific users.

Conditional Access policies

Why wrong: Conditional Access policies enforce access controls during sign-in but do not delegate administrative permissions to manage users.

Privileged Identity Management (PIM)

Why wrong: PIM provides time-based and approval-based role activation but does not restrict the management scope to a specific department.

Using a single, strong firewall to block all external traffic

Why wrong: Relying on a single control creates a single point of failure. Defense in depth requires multiple, overlapping controls, not just one.

Relying solely on encryption to protect all data at rest and in transit

Why wrong: While encryption is important, it is only one layer. Defense in depth also involves other controls such as access controls, monitoring, and physical security.

Implementing only physical security measures to protect the data center

Why wrong: Physical security is a layer of defense, but defense in depth requires additional layers such as network security, application security, and administrative controls.

Accounting

Why wrong: Accounting (auditing) would involve logging user actions, not the initial access control.

Non-repudiation

Why wrong: Non-repudiation ensures users cannot deny their actions (e.g., via digital signatures), not demonstrated here.

Confidentiality, achieved through encryption

Why wrong: Encryption protects data from unauthorized access but does not prove who sent the data; it addresses confidentiality.

Integrity, achieved through hashing

Why wrong: Hashing ensures data has not been altered but does not link the signature uniquely to the sender, so it does not prevent denial of sending.

Access control, achieved through permissions

Why wrong: Access control determines who can read or write data but does not provide a mechanism to prove that a specific action occurred.

Least privilege

Why wrong: Least privilege is a security principle that grants users the minimum level of access needed to perform their job. While RBAC often helps achieve least privilege, the scenario specifically describes assigning permissions by job role, which is RBAC.

Defense in depth

Why wrong: Defense in depth is a security strategy that uses multiple layers of controls. It does not refer to role-based permission assignment.

Zero Trust

Why wrong: Zero Trust is a security model that assumes no implicit trust and verifies every access request. It is broader than role-based assignment.

Integrity

Why wrong: Incorrect. Integrity focuses on maintaining the accuracy and consistency of data, not on restricting access.

Availability

Why wrong: Incorrect. Availability ensures that systems and data are accessible when needed, not specifically who can view them.

Accountability

Why wrong: Incorrect. Accountability is not part of the CIA triad; it involves tracking actions to a specific user, often through auditing.

Confidentiality

Why wrong: Incorrect. Confidentiality ensures that data is accessible only to authorized parties. Backups may also support confidentiality if encrypted, but the primary goal of backups is availability.

Integrity

Why wrong: Incorrect. Integrity ensures data is accurate and unaltered. While backups can restore data integrity, their main purpose is to ensure data is available after a loss.

Non-repudiation

Why wrong: Incorrect. Non-repudiation provides proof that an action or event occurred, such as through digital signatures. Backups do not provide non-repudiation.

Defense in depth

Why wrong: Defense in depth is a strategy that uses multiple layers of security controls to protect assets, not specifically about limiting permissions to the minimum necessary.

Separation of duties

Why wrong: Separation of duties divides critical tasks among different individuals to prevent fraud or error, not about limiting the scope of permissions for a single user.

Zero Trust

Why wrong: Zero Trust is a security model that assumes no implicit trust and verifies every access request; while it includes least privilege as a principle, it is a broader framework and not solely about minimal permissions.

Confidentiality

Why wrong: Confidentiality focuses on ensuring data is accessible only to authorized individuals. Hashing does not prevent unauthorized reading of data; it only detects changes.

Availability

Why wrong: Availability ensures systems and data are accessible when needed. Hashing does not affect system uptime or accessibility.

Non-repudiation

Why wrong: Non-repudiation prevents a party from denying an action, typically achieved through digital signatures. Hashing alone does not provide proof of origin or action.

Integrity

Why wrong: Integrity focuses on ensuring data is accurate and not modified by unauthorized parties. While encryption can protect integrity to some degree, the primary goal described is preventing unauthorized viewing, not modification.

Availability

Why wrong: Availability ensures that data and systems are accessible when needed. The scenario mentions access restrictions and encryption, which do not directly address ensuring uptime or accessibility.

Non-repudiation

Why wrong: Non-repudiation ensures that a user cannot deny having performed an action, often achieved through digital signatures and audit logs. This is not the focus of encryption and access control in this scenario.

A. Confidentiality

Why wrong: Confidentiality is about preventing unauthorized access to information, not about ensuring data has not been altered.

C. Availability

Why wrong: Availability ensures that systems and data are accessible when needed, which is not the primary focus of digital signatures.

D. Non-repudiation

Why wrong: Non-repudiation prevents a party from denying an action, but the main purpose of digital signatures in this scenario is to verify data integrity, not to prove who sent it.

A. Authorization

Why wrong: Authorization determines what resources a verified user can access, not the process of verifying identity.

B. Auditing

Why wrong: Auditing involves logging and reviewing events for compliance or investigation, not the act of proving identity.

D. Accounting

Why wrong: Accounting tracks resource usage and user actions, often for auditing or billing, not for verifying identity.

Defense in depth

Why wrong: Defense in depth is a strategy using multiple layers of security controls (e.g., firewalls, encryption). Regular access reviews do not directly implement this principle.

Zero trust

Why wrong: Zero trust is a security model that assumes no implicit trust and continuously verifies every access request. While access reviews support zero trust, the specific focus on ensuring minimal permissions aligns more directly with least privilege.

Separation of duties

Why wrong: Separation of duties divides critical tasks among multiple users to prevent fraud or error. Access reviews focus on individual permissions, not task division.

Defense in depth

Why wrong: Defense in depth uses multiple layers of security controls, not specifically about limiting permissions per role.

Separation of duties

Why wrong: Separation of duties divides critical actions among multiple people to prevent fraud, not about granting minimal access based on role.

Zero Trust

Why wrong: Zero Trust is a security model that requires verification for every access attempt, but it is broader than simply restricting permissions to the minimum necessary.