View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 381

Which security principle requires access rights to be limited to only the resources and actions necessary for a user to perform assigned responsibilities?

1. Need to know
2. Least privilege
3. Job rotation
4. Separation of duties

Correct Answer: 2

Explanation

Least privilege requires users, processes, and systems to receive only the permissions necessary to perform their authorized functions. Limiting privileges reduces the potential damage caused by compromised accounts, malicious insiders, accidental actions, or exploited applications. Privileges should be reviewed regularly because job responsibilities can change over time. Least privilege applies to administrative accounts, applications, service accounts, operating systems, and other resources. Organizations can strengthen this principle through role-based access, privileged access management, periodic access reviews, and timely removal of unnecessary permissions.

Question 382

A security administrator wants to ensure that an employee can access confidential payroll information only when performing payroll-related duties. Which principle is most directly applicable?

1. Need to know
2. Open design
3. Defense in depth
4. Fail-safe defaults

Correct Answer: 1

Explanation

Need to know restricts access to information based on whether an individual has a legitimate business requirement to access that specific information. A person may have general authorization to use organizational systems but still should not receive access to confidential information unrelated to assigned responsibilities. Applying need to know can reduce unnecessary exposure of sensitive data and limit the consequences of compromised accounts. It is commonly used with least privilege and access control mechanisms to ensure that users receive only the information required for legitimate business activities.

Question 383

Which access control model assigns permissions based primarily on the functions or responsibilities associated with a user’s organizational role?

1. Discretionary access control
2. Mandatory access control
3. Role-based access control
4. Rule-based encryption

Correct Answer: 3

Explanation

Role-based access control, or RBAC, assigns permissions according to predefined organizational roles. Users are assigned to roles such as payroll clerk, database administrator, or security analyst, and each role receives the permissions required for its responsibilities. This approach simplifies administration because permissions can be managed at the role level instead of individually for every user. RBAC also supports consistent access decisions and can help enforce least privilege. Organizations should periodically review role definitions and memberships because outdated assignments can result in excessive or inappropriate access.

Question 384

Which access control model makes authorization decisions using attributes associated with users, resources, actions, and environmental conditions?

1. Role-based access control
2. Attribute-based access control
3. Discretionary access control
4. Mandatory access control

Correct Answer: 2

Explanation

Attribute-based access control, or ABAC, evaluates attributes to determine whether an access request should be permitted. Attributes can describe the user, requested resource, action, location, device, time, security classification, or other relevant conditions. For example, an organization could permit access to a sensitive application only when an authorized employee uses a managed device from an approved location during working hours. ABAC can support highly granular decisions and dynamic policies. However, effective implementation requires accurate attributes, well-designed policies, and reliable enforcement mechanisms.

Question 385

Which access control model allows resource owners to determine who can access their resources?

1. Mandatory access control
2. Role-based access control
3. Discretionary access control
4. Attribute-based access control

Correct Answer: 3

Explanation

Discretionary access control, or DAC, allows the owner of a resource to determine access permissions. The owner can typically grant or revoke access to other users according to organizational rules. DAC provides flexibility but can create security risks if resource owners assign excessive permissions or fail to maintain access lists. It contrasts with mandatory access control, where access decisions are based on centrally defined security labels and rules. Organizations using DAC should combine it with appropriate access reviews, least privilege, and monitoring to reduce unauthorized information exposure.

Question 386

Which access control model uses centrally managed security labels and rules to determine access to classified information?

1. Discretionary access control
2. Mandatory access control
3. Role-based access control
4. Attribute-based access control

Correct Answer: 2

Explanation

Mandatory access control, or MAC, bases authorization decisions on centrally managed security labels and rules. Users and resources can receive classifications such as confidential, secret, or top secret, and access decisions are determined by the defined security policy rather than by individual resource owners. MAC is useful in environments where information classification and strict access enforcement are critical. Because users generally cannot freely change permissions, MAC provides stronger centralized control than DAC. Proper classification, labeling, and policy administration are essential for effective implementation.

Question 387

An organization requires users to provide a password and a hardware security token before accessing a privileged administrative system. What security mechanism is being implemented?

1. Single sign-on
2. Multifactor authentication
3. Federation
4. Password synchronization

Correct Answer: 2

Explanation

Multifactor authentication requires authentication evidence from two or more different factor categories. Common categories include something the user knows, something the user has, and something the user is. A password represents something the user knows, while a hardware security token represents something the user has. Combining different factors provides stronger protection than relying on a password alone because compromising one factor does not automatically provide all required authentication evidence. MFA is particularly valuable for privileged accounts, remote access, and systems containing sensitive information.

Question 388

Which authentication factor category includes fingerprints, facial characteristics, and iris patterns?

1. Something you know
2. Something you have
3. Somewhere you are
4. Something you are

Correct Answer: 4

Explanation

Biometric characteristics such as fingerprints, facial characteristics, iris patterns, and certain behavioral characteristics fall under the “something you are” authentication factor category. Biometrics can provide convenient authentication because the characteristic is associated with the individual rather than being a memorized secret or physical token. However, biometric systems require careful consideration of false acceptance rates, false rejection rates, privacy, enrollment, storage, and template protection. Organizations should select biometric mechanisms appropriate for the risk and should consider alternative authentication methods when biometric verification is unavailable.

Question 389

Which identity management capability allows a user to authenticate once and then access multiple authorized applications without repeatedly providing credentials?

1. Federation
2. Single sign-on
3. Account provisioning
4. Privilege management

Correct Answer: 2

Explanation

Single sign-on, or SSO, allows a user to authenticate once and then access multiple authorized applications without repeatedly entering credentials for each application. SSO can improve usability and reduce the number of passwords users must remember. It can also centralize authentication and simplify account management. However, compromise of the primary authentication mechanism can potentially affect multiple applications, so strong authentication and appropriate session controls are important. SSO is distinct from federation, although federated identity architectures can be used to provide SSO across organizational boundaries.

Question 390

Which capability allows identities from one organization or security domain to be trusted by another domain?

1. Identity federation
2. Password hashing
3. Account lockout
4. Local authentication

Correct Answer: 1

Explanation

Identity federation allows organizations or security domains to establish trust relationships so that identities authenticated by one domain can be recognized by another. This can support access to external applications, cloud services, or partner resources without requiring separate local identities for every service. Federation commonly relies on established trust relationships and identity assertions exchanged between participating systems. Security administrators must carefully define trust boundaries, authentication requirements, attribute sharing, session management, and revocation processes to prevent inappropriate access across organizational boundaries.

Question 391

Which security principle requires an authorization check every time a subject attempts to access a protected object?

1. Least common mechanism
2. Complete mediation
3. Psychological acceptability
4. Open design

Correct Answer: 2

Explanation

Complete mediation requires every access attempt to a protected resource to be checked against the applicable authorization policy. The principle prevents a system from relying on an earlier authorization decision indefinitely when circumstances or permissions may have changed. Implementing complete mediation helps prevent unauthorized access caused by stale permissions or bypassed checks. Security mechanisms should be designed so that protected resources cannot be accessed through an alternate path that avoids authorization enforcement. Performance considerations may require efficient implementations, but security checks should remain effective.

Question 392

Which security design principle recommends that security mechanisms should remain straightforward and contain as little unnecessary complexity as possible?

1. Economy of mechanism
2. Open design
3. Least privilege
4. Defense in depth

Correct Answer: 1

Explanation

Economy of mechanism recommends keeping security mechanisms simple and minimizing unnecessary complexity. Simpler designs are generally easier to understand, implement, test, maintain, and audit. Excessive complexity can introduce configuration errors, hidden dependencies, and vulnerabilities that are difficult to identify. The principle does not mean eliminating necessary security controls; instead, it encourages efficient and understandable security mechanisms. Organizations should consider simplicity when designing authentication systems, access controls, network architectures, application security mechanisms, and administrative procedures.

Question 393

Which security design principle states that the security of a system should not depend on keeping its design secret?

1. Fail-safe defaults
2. Open design
3. Separation of duties
4. Need to know

Correct Answer: 2

Explanation

The open design principle states that security should not depend on keeping the design or implementation approach secret. Instead, protection should rely on well-designed security mechanisms, properly protected keys, strong authentication, and appropriate access controls. Openly understood designs can receive broader review, testing, and analysis, potentially helping identify weaknesses. This principle is especially important in cryptography, where algorithms may be publicly known while secret keys provide confidentiality. Relying on secrecy of system design can create false confidence and may make independent security evaluation more difficult.

Question 394

Which security design principle requires a system to deny access by default unless explicit authorization has been granted?

1. Fail-safe defaults
2. Open design
3. Least common mechanism
4. Complete mediation

Correct Answer: 1

Explanation

Fail-safe defaults require systems to deny access unless a request has been explicitly authorized. This approach reduces the chance that configuration errors or unexpected conditions will accidentally result in excessive access. For example, a newly created account should not automatically receive access to sensitive resources simply because permissions were not explicitly configured. Administrators should deliberately grant required permissions rather than relying on broad default access. Fail-safe defaults are particularly important for access control lists, firewall rules, application permissions, and other mechanisms that enforce security decisions.

Question 395

Which security design principle recommends minimizing the mechanisms shared between users or processes to reduce unintended interaction?

1. Complete mediation
2. Least common mechanism
3. Open design
4. Fail-safe defaults

Correct Answer: 2

Explanation

The least common mechanism principle recommends minimizing the amount of functionality or resources shared among users, processes, or security domains. Excessive sharing can create unintended communication paths and increase the potential impact of a compromise. Separating resources can reduce opportunities for information leakage, privilege abuse, and cross-process interference. Examples include isolating application processes, separating administrative interfaces, and limiting shared services. This principle complements least privilege and segmentation by reducing unnecessary dependencies and limiting the number of components that must be trusted across security boundaries.

Question 396

Which security concept is primarily concerned with proving that an individual or system performed a particular action and can be held responsible for it?

1. Availability
2. Accountability
3. Confidentiality
4. Redundancy

Correct Answer: 2

Explanation

Accountability ensures that actions can be associated with identifiable individuals, systems, or processes so responsibility can be established. It commonly depends on authentication, authorization, logging, monitoring, and reliable time synchronization. For example, an audit trail that records which authenticated administrator changed a configuration can support accountability. Accountability is different from confidentiality, which protects information from unauthorized disclosure. Strong accountability mechanisms should protect logs from unauthorized alteration and should retain sufficient information to support investigations, compliance activities, and security monitoring.

Question 397

Which security property ensures that information is protected from unauthorized disclosure?

1. Integrity
2. Availability
3. Confidentiality
4. Accountability

Correct Answer: 3

Explanation

Confidentiality ensures that information is accessible only to authorized individuals, systems, or processes. Controls supporting confidentiality include access controls, encryption, data classification, information handling procedures, network segmentation, and secure authentication. Confidentiality is one component of the CIA triad, along with integrity and availability. A confidentiality failure occurs when sensitive information is disclosed to an unauthorized party, whether through an attack, accidental exposure, misconfiguration, or inappropriate access. Organizations should identify sensitive information and apply protection measures based on its classification and associated risk.

Question 398

Which security property ensures that information remains accurate, complete, and protected from unauthorized modification?

1. Integrity
2. Confidentiality
3. Availability
4. Privacy

Correct Answer: 1

Explanation

Integrity ensures that information remains accurate, complete, and protected against unauthorized or improper modification. Controls supporting integrity include hashing, digital signatures, file integrity monitoring, access controls, change management, and transaction validation. An integrity violation can occur when an attacker alters records, malware modifies files, or an authorized user makes an unauthorized change. Integrity is one component of the CIA triad. Organizations should protect both stored and transmitted information against unauthorized modification and establish mechanisms for detecting changes that should not have occurred.

Question 399

Which security property focuses on ensuring that authorized users can access systems and information when needed?

1. Confidentiality
2. Integrity
3. Availability
4. Nonrepudiation

Correct Answer: 3

Explanation

Availability ensures that authorized users can access systems, applications, and information when required for legitimate business purposes. Availability can be supported through redundancy, fault tolerance, backups, disaster recovery, capacity management, monitoring, resilient architecture, and protection against denial-of-service attacks. Availability requirements should be aligned with business needs because different services may have different tolerance levels for downtime. Excessive focus on availability without considering confidentiality and integrity can create additional risks, so organizations should maintain a balanced approach across all three elements of the CIA triad.

Question 400

Which security concept provides evidence that a party cannot credibly deny having performed a specific action or transaction?

1. Authorization
2. Nonrepudiation
3. Availability
4. Data minimization

Correct Answer: 2

Explanation

Nonrepudiation provides evidence that can help prevent a party from credibly denying involvement in a specific transaction or action. Digital signatures are a common mechanism used to support nonrepudiation because they can associate signed information with a private key under appropriate key management and validation conditions. Reliable identity verification, protected private keys, timestamps, and audit records can further strengthen evidence. Nonrepudiation is distinct from authentication and accountability: authentication establishes identity, while accountability associates actions with entities, and nonrepudiation provides stronger evidence against later denial.