SC-900 Security, Compliance & Identity Concepts 4 — Questions and Answers
Question 1: Which compliance regulation is primarily focused on protecting the personal data and privacy of individuals in the European Union?
- HIPAA
- PCI DSS
- GDPR (Correct answer)
- SOX
Correct answer: GDPR
The General Data Protection Regulation (GDPR) is an EU law that governs how organizations collect, store, and process personal data of EU residents.
Question 2: What is 'privilege escalation' in cybersecurity?
- Granting temporary admin access for approved maintenance tasks
- An attacker gaining higher-level permissions than originally authorized (Correct answer)
- Increasing the number of privileged accounts in an organization
- Using automation to streamline access approval workflows
Correct answer: An attacker gaining higher-level permissions than originally authorized
Privilege escalation occurs when an attacker exploits a vulnerability or misconfiguration to gain elevated permissions beyond what they were initially granted.
Question 3: In Microsoft's identity model, what is an 'Azure AD tenant'?
- A physical data center region where Azure resources are hosted
- A dedicated and isolated instance of Azure Active Directory for an organization (Correct answer)
- A subscription-level billing container for Azure services
- A role assigned to cloud administrators
Correct answer: A dedicated and isolated instance of Azure Active Directory for an organization
An Azure AD tenant is an organization's dedicated instance of Azure Active Directory, containing its users, groups, and registered applications.
Question 4: What is 'business continuity planning' designed to ensure?
- That all security vulnerabilities are patched before deployment
- That an organization can continue critical operations during and after a disruption (Correct answer)
- That employee data is backed up daily to offsite storage
- That all compliance audits are completed on schedule
Correct answer: That an organization can continue critical operations during and after a disruption
Business continuity planning identifies critical functions and establishes procedures to maintain or quickly restore them during disruptions such as disasters or cyberattacks.
Question 5: Which authentication method requires users to possess a physical device that generates time-based codes?
- Knowledge-based authentication
- Hardware token (TOTP) (Correct answer)
- Password spray authentication
- Biometric authentication
Correct answer: Hardware token (TOTP)
A hardware token generates Time-based One-Time Passwords (TOTP) that change every 30 seconds, requiring physical possession to authenticate.
Question 6: What is the primary goal of a 'penetration test'?
- To install security patches across all systems in the network
- To simulate real-world attacks and identify exploitable vulnerabilities before malicious actors do (Correct answer)
- To monitor network traffic for signs of ongoing intrusions
- To train employees on how to recognize phishing emails
Correct answer: To simulate real-world attacks and identify exploitable vulnerabilities before malicious actors do
A penetration test is an authorized simulated cyberattack on a system to evaluate its security posture and identify weaknesses before they can be exploited.
Question 7: What does 'integrity' mean in the CIA triad of information security?
- Ensuring data is accessible only to authorized users
- Ensuring data remains accurate and unaltered except through authorized processes (Correct answer)
- Ensuring systems are available when needed by authorized users
- Ensuring all user actions are logged and auditable
Correct answer: Ensuring data remains accurate and unaltered except through authorized processes
Integrity in the CIA triad means ensuring that data is accurate, complete, and has not been tampered with or modified by unauthorized parties.
SC-900 Security, Compliance & Identity Concepts 4
Which compliance regulation is primarily focused on protecting the personal data and privacy of individuals in the European Union?