Security & Access Control Flashcards

Which principle says an analytics user should receive only the permissions needed to do their job?

Answer: Least privilege

Least privilege limits each account to the minimum access required for its tasks.

A new intern needs to view dashboards but must not change tracking configuration. Which role fits best?

Answer: Viewer / read-only

A read-only role allows viewing reports without altering configuration.

What is the main security benefit of enabling two-factor authentication on an analytics account?

Answer: Protection if the password is stolen

A second factor blocks access even when the password has been compromised.

Which practice is most appropriate when an employee with analytics access leaves the company?

Answer: Immediately revoke their access

Prompt deprovisioning prevents unauthorized access by former staff.

Why should agencies be given access via individual named user accounts rather than a shared login?

Answer: Individual accounts provide accountability and audit trails

Named accounts let you trace actions to a person and revoke access individually.

Which data element is generally considered personally identifiable information (PII) that should NOT be sent to analytics tools?

Answer: Customer email address

Email addresses directly identify a person and violate most analytics vendor terms.

Which transport protocol should analytics data collection use to protect data in transit?

Answer: HTTPS

HTTPS encrypts hits between the browser and the collection server.