HAC Security & Authentication 2 — Questions and Answers
Question 1: What does HubSpot's IP allowlisting feature allow administrators to do?
- Block all external email traffic
- Restrict portal access to specific IP addresses or ranges (Correct answer)
- Limit the number of API calls per IP
- Prevent users from exporting data
Correct answer: Restrict portal access to specific IP addresses or ranges
IP allowlisting lets admins restrict HubSpot portal access to approved IP addresses or CIDR ranges, adding a network-layer security control.
Question 2: When a HubSpot admin enables 'require two-factor authentication' for the account, what happens to users who haven't set up 2FA?
- They are immediately logged out and cannot access HubSpot until 2FA is configured (Correct answer)
- They can continue working for 7 days before being required to set up 2FA
- They receive a warning but can still log in indefinitely
- They are automatically enrolled in SMS-based 2FA
Correct answer: They are immediately logged out and cannot access HubSpot until 2FA is configured
When account-level 2FA enforcement is enabled, users without 2FA configured are locked out and must set it up before gaining access.
Question 3: Which HubSpot permission controls whether a user can install or uninstall connected integrations?
- Account access permission
- App Marketplace permission (Correct answer)
- Super admin privilege only
- CRM settings permission
Correct answer: App Marketplace permission
The App Marketplace permission governs a user's ability to install, configure, and remove third-party integrations from the HubSpot App Marketplace.
Question 4: What is the maximum number of active API keys a HubSpot portal can have at one time (legacy private app model)?
- 1 (Correct answer)
- 5
- 10
- Unlimited
Correct answer: 1
Each HubSpot portal can have only one active legacy API key at a time, which is one reason private apps with tokens are now preferred.
Question 5: In HubSpot, what security advantage do private apps have over legacy API keys?
- Private apps support higher rate limits
- Private apps use scoped tokens, limiting access to only permitted data (Correct answer)
- Private apps automatically rotate credentials monthly
- Private apps bypass IP allowlisting restrictions
Correct answer: Private apps use scoped tokens, limiting access to only permitted data
Private app tokens are scoped to only the specific permissions granted during setup, reducing the blast radius if a token is compromised.
Question 6: Which login option can HubSpot admins configure to allow users to authenticate using corporate credentials without a separate HubSpot password?
- OAuth 2.0 client flow
- SAML-based Single Sign-On (SSO) (Correct answer)
- API key authentication
- Magic link login
Correct answer: SAML-based Single Sign-On (SSO)
SAML-based SSO lets users authenticate via an identity provider (like Okta or Azure AD) so they use corporate credentials to access HubSpot.
Question 7: What happens to a HubSpot user's session when an admin deactivates their account?
- The session persists until the browser is closed
- The session is invalidated immediately and the user is logged out (Correct answer)
- The user can finish their current task but cannot log back in
- The session persists for up to 24 hours
Correct answer: The session is invalidated immediately and the user is logged out
Deactivating a user in HubSpot immediately terminates their active sessions, preventing any further access.
HAC Security & Authentication 2
What does HubSpot's IP allowlisting feature allow administrators to do?