SC-900 Security, Compliance & Identity Concepts 5 — Questions and Answers
Question 1: What is 'identity governance' primarily concerned with?
- Monitoring network traffic for anomalies
- Managing and enforcing policies around who has access to what and certifying that access is appropriate (Correct answer)
- Encrypting identity tokens during transmission
- Providing single sign-on capabilities across applications
Correct answer: Managing and enforcing policies around who has access to what and certifying that access is appropriate
Identity governance ensures the right people have the right access to the right resources through policy enforcement, access reviews, and audit trails.
Question 2: Which of the following best describes a 'Distributed Denial of Service (DDoS)' attack?
- Encrypting a victim's files and demanding a ransom payment
- Flooding a target system with traffic from multiple sources to make it unavailable (Correct answer)
- Stealing user credentials through fake login pages
- Injecting malicious code into a web application's database
Correct answer: Flooding a target system with traffic from multiple sources to make it unavailable
A DDoS attack overwhelms a target (website, server, or network) with massive traffic from many compromised systems, rendering it unavailable to legitimate users.
Question 3: What is the purpose of 'eDiscovery' in a compliance context?
- Automatically discovering and classifying new data as it is created
- Identifying, collecting, and producing electronically stored information for legal proceedings (Correct answer)
- Scanning cloud storage for malware and policy violations
- Discovering unused user accounts for deprovisioning
Correct answer: Identifying, collecting, and producing electronically stored information for legal proceedings
eDiscovery is the process of locating, preserving, and producing electronically stored information (ESI) in response to legal requests, audits, or investigations.
Question 4: In a zero trust model, which of the following is a core guiding principle?
- Trust users once they have authenticated inside the corporate network
- Assume breach and verify every request explicitly, regardless of origin (Correct answer)
- Block all external access and allow only internal network traffic
- Grant admin rights to all IT staff to speed up operations
Correct answer: Assume breach and verify every request explicitly, regardless of origin
Zero trust operates on the principle of 'assume breach,' requiring explicit verification of every access request and granting least-privilege access continuously.
Question 5: What distinguishes 'authentication' from 'authorization'?
- Authentication determines what a user can do; authorization verifies who they are
- Authentication verifies who a user is; authorization determines what they are allowed to do (Correct answer)
- Authentication encrypts user data; authorization stores it securely
- Authentication manages session tokens; authorization manages passwords
Correct answer: Authentication verifies who a user is; authorization determines what they are allowed to do
Authentication is the process of verifying identity (who you are), while authorization determines what resources and actions an authenticated identity is permitted to access.
Question 6: What is a 'security baseline' in the context of compliance?
- The minimum security requirements and configurations that all systems must meet (Correct answer)
- A historical report showing past security incidents
- The starting point budget allocated for cybersecurity tools
- A list of all approved software vendors
Correct answer: The minimum security requirements and configurations that all systems must meet
A security baseline defines the minimum set of security controls and configurations required for all systems to reduce risk to an acceptable level.
Question 7: Which standard provides a framework of best practices for information security management?
- ISO/IEC 27001 (Correct answer)
- PCI DSS
- NIST SP 800-53
- SOC 2
Correct answer: ISO/IEC 27001
ISO/IEC 27001 is an internationally recognized standard that specifies requirements for establishing, implementing, and maintaining an Information Security Management System (ISMS).
SC-900 Security, Compliance & Identity Concepts 5
What is 'identity governance' primarily concerned with?