OCPS Payroll Software Systems & Security Protocols 3 — Questions and Answers
Question 1: Which of the following best describes a 'Software as a Service' (SaaS) payroll deployment model?
- Payroll software is installed on each employee's local computer
- The payroll application is hosted by a vendor and accessed via the internet (Correct answer)
- The company owns and maintains all payroll servers on-premises
- Payroll is processed manually using spreadsheets
Correct answer: The payroll application is hosted by a vendor and accessed via the internet
SaaS payroll systems are vendor-hosted and accessed through a web browser, reducing the need for on-premises infrastructure.
Question 2: What is the primary risk associated with using weak or reused passwords for payroll system accounts?
- Slower system performance
- Increased vulnerability to unauthorized access and data theft (Correct answer)
- Higher payroll processing costs
- Inability to generate payroll reports
Correct answer: Increased vulnerability to unauthorized access and data theft
Weak or reused passwords make it easier for attackers to gain unauthorized access to sensitive payroll data through brute force or credential stuffing attacks.
Question 3: In payroll security, 'data masking' is used to:
- Encrypt payroll transmissions over the network
- Hide sensitive data such as SSNs from unauthorized viewers while keeping it usable (Correct answer)
- Delete old payroll records permanently
- Create backup copies of employee data
Correct answer: Hide sensitive data such as SSNs from unauthorized viewers while keeping it usable
Data masking replaces sensitive values with fictional but realistic-looking data, allowing authorized users to work with datasets without exposing real sensitive information.
Question 4: Which federal law requires employers to protect the confidentiality of employees' personal information, including payroll data?
- Fair Labor Standards Act (FLSA)
- Gramm-Leach-Bliley Act (GLBA)
- Privacy Act of 1974 and state-level data protection laws (Correct answer)
- Equal Pay Act
Correct answer: Privacy Act of 1974 and state-level data protection laws
The Privacy Act of 1974 and various state-level laws establish requirements for employers to safeguard employees' personal information including payroll records.
Question 5: When integrating a payroll system with a third-party benefits provider, what security measure is most critical?
- Sharing admin credentials with the vendor
- Using secure API connections with authentication tokens (Correct answer)
- Sending employee data via unencrypted email
- Allowing the vendor unrestricted database access
Correct answer: Using secure API connections with authentication tokens
Secure API connections with authentication tokens ensure that data exchanged between systems is encrypted and only accessible to authorized parties.
Question 6: A payroll administrator receives an email requesting immediate transfer of payroll funds to a new account. This is most likely an example of:
- A routine bank change request
- A phishing or social engineering attack (Correct answer)
- An authorized payroll adjustment
- A direct deposit update from HR
Correct answer: A phishing or social engineering attack
Urgent requests for fund transfers or account changes via email are classic signs of phishing or business email compromise (BEC) attacks targeting payroll.
Question 7: What is the purpose of a 'penetration test' conducted on a payroll system?
- To process payroll for a test pay period
- To simulate cyberattacks and identify security vulnerabilities before malicious actors exploit them (Correct answer)
- To verify that payroll calculations are mathematically correct
- To test the speed of payroll processing
Correct answer: To simulate cyberattacks and identify security vulnerabilities before malicious actors exploit them
Penetration testing involves authorized simulated attacks on the payroll system to discover and remediate security weaknesses proactively.
OCPS Payroll Software Systems & Security Protocols 3
Which of the following best describes a 'Software as a Service' (SaaS) payroll deployment model?