View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 81

Which access model assigns permissions according to predefined organizational job functions?

1. Role-based access control
2. Mandatory encryption control
3. Location-based routing
4. Resource scheduling

Correct Answer: 4

Explanation:

Role-based access control, or RBAC, assigns permissions according to defined roles rather than individually configuring every permission for every user. A role may correspond to a job function, such as accountant, system administrator, or human resources specialist. Users receive access based on the roles assigned to them. RBAC can simplify administration and support consistent application of least privilege when roles are carefully designed. Organizations should periodically review roles because excessive permissions can accumulate as responsibilities change. Role definitions should reflect actual business requirements and should avoid granting broad access merely for administrative convenience.

Question 82

Which authentication factor uses a physical object possessed by the user?

1. Password
2. Security token
3. Fingerprint pattern
4. Personal knowledge question

Correct Answer: 2

Explanation:

A security token is an example of a possession-based authentication factor because it represents something the user has. Tokens can take different forms, including hardware devices, smart cards, or software-generated authentication mechanisms. Authentication factors are commonly categorized as something you know, something you have, and something you are. Combining different factor categories can provide stronger authentication than relying on only one type. Possession-based authentication still requires appropriate lifecycle management because lost, stolen, or compromised tokens can create security exposure. Organizations should establish procedures for issuance, replacement, revocation, and monitoring of authentication devices.

Question 83

Which access principle requires permissions to be limited to only what a user needs for assigned duties?

1. Maximum privilege
2. Universal access
3. Least privilege
4. Administrative inheritance

Correct Answer: 1

Explanation:

Least privilege requires users, applications, and other entities to receive only the permissions necessary to perform their authorized responsibilities. Limiting privileges reduces the potential damage caused by compromised accounts, accidental actions, or misuse of authorized access. The principle can apply to employees, administrators, service accounts, applications, and automated processes. Privileges should be reviewed as responsibilities change because access that was appropriate in one role may become unnecessary later. Organizations often combine least privilege with role-based access, privileged access management, periodic reviews, and separation of duties to create stronger access governance.

Question 84

Which process removes access when an employee leaves an organization?

1. Capacity planning
2. Account deprovisioning
3. Software compilation
4. Network optimization

Correct Answer: 3

Explanation:

Account deprovisioning removes or disables access when a user’s employment or authorized relationship with an organization ends. Timely deprovisioning helps prevent former personnel from retaining access to applications, systems, facilities, or information. An effective offboarding process may address user accounts, privileged credentials, badges, tokens, remote access, shared resources, and organization-owned devices. Automation can improve consistency when identity systems are integrated with human resources workflows. Organizations should also identify service accounts or shared credentials that could have been known to departing personnel and determine whether those secrets require replacement.

Question 85

Why should privileged accounts receive additional monitoring?

1. They have elevated capabilities that can cause significant impact
2. They cannot be compromised
3. They are used only for email
4. They automatically prevent malware

Correct Answer: 3

Explanation:

Privileged accounts have elevated permissions that may allow users to modify systems, access sensitive information, change security settings, or create additional accounts. Because misuse or compromise of such accounts can have substantial consequences, organizations commonly apply stronger controls to them. These can include multifactor authentication, privileged access management, session monitoring, approval workflows, credential vaulting, and detailed logging. Administrative privileges should be granted only when necessary and for an appropriate duration. Monitoring privileged activity helps organizations detect suspicious behavior and provides useful evidence when investigating unauthorized changes or potential misuse.

Question 86

Which approach grants elevated permissions only for the period they are actually required?

1. Permanent authorization
2. Just-in-time access
3. Anonymous administration
4. Shared privilege allocation

Correct Answer: 4

Explanation:

Just-in-time access provides elevated permissions only when they are required and generally for a limited period. This approach reduces the amount of time that privileged credentials remain available for misuse or compromise. Instead of maintaining permanent administrative access, an authorized user can request temporary privileges for a specific task. Organizations may combine this model with approval workflows, multifactor authentication, session recording, and automatic privilege expiration. Just-in-time access supports least privilege by reducing persistent exposure. Its effectiveness depends on well-defined authorization processes and reliable controls that remove elevated access after the approved period ends.

Question 87

What is the primary purpose of single sign-on?

1. To allow users to authenticate once and access multiple authorized services
2. To eliminate authorization decisions
3. To remove all identity records
4. To disable multifactor authentication

Correct Answer: 1

Explanation:

Single sign-on, or SSO, allows a user to authenticate through a trusted identity service and then access multiple authorized applications without independently signing in to each application. SSO can improve user experience and centralize aspects of identity management. It can also support consistent authentication policies when applications integrate correctly with the organization’s identity provider. SSO does not eliminate authorization because each application still needs to determine what the authenticated user is permitted to access. Strong authentication, including multifactor authentication where appropriate, should remain part of the identity architecture.

Question 88

Which identity process ensures permissions are reconsidered when an employee changes responsibilities?

1. Network discovery
2. Access recertification
3. Data compression
4. Hardware disposal

Correct Answer: 2

Explanation:

Access recertification involves periodically reviewing assigned permissions to determine whether they remain appropriate. It is particularly important when personnel change roles, departments, responsibilities, or organizational status. A mover may accumulate permissions from a previous role if access is not adjusted, creating unnecessary privilege. During recertification, managers or designated owners can confirm, modify, or remove access according to current business requirements. Automated identity workflows can reduce delays, but human review may still be required for sensitive resources. Regular certification supports least privilege and helps organizations identify stale, excessive, or inappropriate access.

Question 89

What security concern is associated with shared administrator accounts?

1. They improve individual accountability
2. They make attribution of actions more difficult
3. They guarantee stronger authentication
4. They automatically rotate credentials

Correct Answer: 3

Explanation:

Shared administrator accounts can weaken accountability because multiple people use the same identity. When actions are recorded under one shared username, investigators may have difficulty determining which individual performed a particular activity. Shared credentials can also complicate password rotation and increase the consequences if the credential becomes exposed. Where practical, organizations should provide individually attributable administrative identities and use privileged access controls. If shared accounts are unavoidable because of technical limitations, compensating controls such as stronger logging, credential vaulting, approval procedures, and session monitoring can help reduce associated risks.

Question 90

Which control helps prevent a user from approving their own sensitive transaction?

1. Separation of duties
2. Password expiration
3. Network translation
4. Storage replication

Correct Answer: 4

Explanation:

Separation of duties divides sensitive responsibilities among different individuals so that one person does not control an entire high-risk process. For example, the employee who creates a financial transaction may be different from the person who approves it. This reduces opportunities for fraud, unauthorized changes, and undetected errors. Separation of duties is particularly useful for activities involving financial transactions, privileged administration, security changes, or other high-impact operations. Organizations should identify conflicting responsibilities and establish appropriate approval workflows. The exact separation required depends on organizational structure, risk, staffing, and the sensitivity of the activity.

Question 91

Which network design places a public-facing service behind controlled filtering before allowing internal access?

1. Segmented architecture
2. Open switching
3. Flat networking
4. Unrestricted bridging

Correct Answer: 2

Explanation:

A segmented architecture separates network resources into controlled zones and regulates communication between them. Public-facing services can be placed in an isolated segment while internal systems remain behind additional security boundaries. This design reduces unnecessary direct connectivity and can limit the potential impact of a compromised public service. Firewalls, access-control rules, routing restrictions, and monitoring can enforce communication boundaries. Segmentation should be based on actual business and technical dependencies because overly broad connectivity can weaken the intended protection. Network architecture should also be reviewed as applications and infrastructure evolve.

Question 92

Which device primarily enforces traffic rules between separate network security zones?

1. Firewall
2. Printer server
3. Storage controller
4. Patch repository

Correct Answer: 1

Explanation:

A firewall enforces defined rules governing network traffic between connected zones or interfaces. Depending on its capabilities, a firewall can evaluate addresses, ports, protocols, applications, identities, or other characteristics before allowing or blocking communication. Firewalls can help reduce unauthorized connectivity and enforce segmentation requirements. Their effectiveness depends on accurate rule design, proper configuration, monitoring, and periodic review. An overly permissive rule set can undermine protection, while obsolete rules can create unnecessary exposure. Firewalls should therefore be managed as part of a broader security architecture rather than treated as a complete solution by themselves.

Question 93

What is the main function of an intrusion prevention system?

1. To provide employee payroll
2. To identify and potentially block malicious network activity
3. To manage building temperature
4. To archive inactive accounts

Correct Answer: 3

Explanation:

An intrusion prevention system, or IPS, monitors network activity for patterns associated with malicious or unauthorized behavior and can take preventive action when configured to do so. Depending on the implementation, an IPS may block traffic, reset connections, or otherwise disrupt suspected attacks. It differs from an intrusion detection system, which primarily identifies and alerts on suspicious activity without necessarily blocking it. IPS rules require careful tuning because legitimate traffic can sometimes resemble attack patterns. Organizations should monitor performance and review detection logic regularly to balance security protection with the risk of false positives.

Question 94

Which technology is designed to identify suspicious behavior across multiple security telemetry sources?

1. File transfer service
2. Cross-domain printer
3. Extended detection and response
4. Basic disk formatter

Correct Answer: 4

Explanation:

Extended detection and response, or XDR, is designed to combine security telemetry and detection capabilities across multiple technology domains. Depending on the platform, these sources may include endpoints, email systems, network activity, identity services, and cloud environments. By connecting related observations, XDR can provide broader visibility into attack activity than a single isolated security control. It may also support investigation and response workflows. XDR implementations differ between vendors, so organizations should evaluate the actual data sources, integrations, detection capabilities, and response functions provided rather than assuming every platform offers identical functionality.

Question 95

Which security solution can inspect and enforce policies for sensitive information transmitted through email?

1. Email data loss prevention
2. Power management controller
3. Inventory barcode system
4. Cooling automation service

Correct Answer: 1

Explanation:

Email data loss prevention controls can inspect messages and attachments for sensitive information and apply organizational policies to reduce unauthorized disclosure. Depending on configuration, the system may detect patterns associated with regulated information, confidential documents, or other protected data. Actions can include blocking delivery, quarantining a message, alerting security personnel, or requiring additional review. Effective email DLP depends on accurate policy definitions and appropriate classification of sensitive information. Organizations should also account for legitimate business communication so that security controls do not unnecessarily interfere with authorized data sharing.

Question 96

What security benefit does multifactor authentication provide?

1. It removes the need for usernames
2. It requires evidence from more than one authentication factor category
3. It guarantees that passwords cannot be stolen
4. It eliminates account management

Correct Answer: 3

Explanation:

Multifactor authentication, or MFA, requires authentication using evidence from multiple factor categories, such as something the user knows, possesses, or physically is. This provides an additional security layer because compromise of one factor alone may not be sufficient to gain access. For example, a stolen password may be less useful when a separate authentication factor is also required. MFA does not make accounts invulnerable because attackers may target additional factors through techniques such as phishing or social engineering. Organizations should therefore combine MFA with secure identity management, monitoring, user education, and appropriate authentication policies.

Question 97

Which attack attempts to reuse stolen username and password combinations against unrelated services?

1. Credential stuffing
2. Packet fragmentation
3. Certificate renewal
4. Session synchronization

Correct Answer: 4

Explanation:

Credential stuffing occurs when attackers use previously stolen username and password combinations to attempt authentication against other services. The technique relies on password reuse across different accounts or platforms. Unlike password spraying, which typically tries a limited set of common passwords across many accounts, credential stuffing uses known credential pairs obtained from previous compromises or other sources. Multifactor authentication, password managers, unique passwords, login monitoring, and detection of unusual authentication patterns can reduce exposure. Organizations should also monitor for compromised credentials and provide users with clear guidance against reusing passwords across unrelated services.

Question 98

Which control is intended to restrict applications from executing unauthorized software on managed endpoints?

1. Unrestricted scripting
2. Application allowlisting
3. Open file sharing
4. Anonymous execution

Correct Answer: 2

Explanation:

Application allowlisting permits only approved applications, binaries, scripts, or software components to execute according to defined organizational policies. By restricting execution to trusted software, allowlisting can reduce the opportunity for unauthorized or malicious programs to run on managed systems. Implementation can involve file hashes, trusted publishers, paths, certificates, or other identification mechanisms depending on the technology. Maintaining an accurate allowlist requires operational effort because legitimate software changes over time. Organizations should establish processes for approving new applications and handling emergency exceptions while ensuring that exceptions do not become permanent uncontrolled pathways.

Question 99

Why should service accounts be managed separately from ordinary user accounts?

1. They are typically used by applications or automated processes
2. They never require authentication
3. They cannot possess privileges
4. They are always temporary accounts

Correct Answer: 1

Explanation:

Service accounts are commonly used by applications, automated jobs, system components, or services that need to authenticate to other resources. Their credentials and permissions therefore require careful management because compromise can allow an attacker to operate through an automated identity. Organizations should assign only necessary privileges, protect service credentials, monitor their activity, and establish appropriate rotation or replacement procedures. Service accounts can be overlooked because they are not associated with a typical employee lifecycle. Maintaining an inventory of non-human identities helps organizations identify unused accounts, excessive permissions, outdated credentials, and other sources of unnecessary exposure.

Question 100

Which security principle requires systems to provide only the functionality necessary for their intended purpose?

1. Maximum functionality
2. Feature expansion
3. Least functionality
4. Universal service exposure

Correct Answer: 2

Explanation:

Least functionality requires systems to provide only the capabilities necessary to perform their intended business or technical functions. Unnecessary services, applications, ports, protocols, and features can increase the attack surface and create additional opportunities for exploitation. Disabling unused functionality can therefore reduce exposure and simplify system administration. The appropriate configuration depends on the system’s purpose and operational requirements. Organizations should use secure configuration baselines, change management, and periodic reviews to identify unnecessary components. Least functionality works alongside least privilege: one limits what a system can do, while the other limits what an authorized identity can access or perform.