Security & Access Control Flashcards

What is the main security benefit of storing encryption master keys in a hardware security module (HSM)?

Answer: Keys are generated and kept in tamper-resistant hardware that prevents extraction

HSMs are tamper-resistant devices that protect key material and perform cryptographic operations without exposing keys.

Which technique adds calibrated statistical noise so that aggregate analytics can be shared without revealing whether a given person is in the dataset?

Answer: Differential privacy

Differential privacy adds mathematically bounded noise that protects individuals while keeping aggregate statistics useful.

A former employee's account was still active three months after they left. Which process failure does this show?

Answer: Poor deprovisioning in the identity lifecycle (joiner-mover-leaver)

Leaver processes must revoke access quickly at termination to prevent orphaned accounts.

Which framework organizes cybersecurity activities into the functions Govern, Identify, Protect, Detect, Respond, and Recover?

Answer: NIST Cybersecurity Framework 2.0

NIST CSF 2.0 added Govern to the original five core functions.

Dynamic data masking differs from static masking because it:

Answer: Hides sensitive values at query time based on the user's privileges while leaving the stored data unchanged

Dynamic masking hides data on the fly in query results, so authorized users can still see the real values.

Which control best addresses insider threat from privileged database administrators?

Answer: Privileged session monitoring and immutable audit logging

Monitoring privileged sessions and keeping tamper-proof logs deters and detects misuse by trusted insiders.

An organization must keep EU customer data stored within EU borders. This requirement is best described as:

Answer: Data residency or localization

Data residency requirements dictate the geographic location where data must be stored or processed.