Security & Access Management Flashcards

A graphic design firm discovers an ex-employee's login is still active months after termination. This is a failure of which security process?

Answer: Offboarding procedures

Proper offboarding procedures include immediate deactivation of all system credentials when an employee leaves the organization.

Which type of access control list (ACL) entry explicitly prevents a specific user from accessing a particular resource, overriding any other permissions?

Answer: Deny entry

Deny entries in an ACL explicitly block access for a specific user or group and typically take precedence over allow entries.

In graphic production security, 'data classification' helps organizations by:

Answer: Categorizing data by sensitivity to apply appropriate protection levels

Data classification assigns sensitivity labels (e.g., public, internal, confidential) so that appropriate security controls can be applied to each category.

Which security concept ensures that a user cannot later deny having performed a specific action, such as approving a print job?

Answer: Non-repudiation

Non-repudiation uses mechanisms like digital signatures and audit logs to provide proof of an action that cannot be denied by the actor.

A rogue employee attempts to access a secure file server by trying thousands of common password combinations automatically. This attack is called a:

Answer: Brute force attack

A brute force attack systematically tries all possible combinations until the correct password is found, without prior knowledge of likely passwords.

When setting up a new workstation for a graphic designer, which security hardening step reduces the system's attack surface?

Answer: Disabling unnecessary services and removing unused applications

Removing unused applications and disabling unnecessary services reduces the number of potential vulnerabilities available to attackers.

Which international standard provides a framework for establishing, implementing, and managing an Information Security Management System (ISMS)?

Answer: ISO 27001

ISO 27001 is the globally recognized standard for information security management systems, providing requirements for systematic risk management.