SP Security and Compliance 2 — Questions and Answers
Question 1: What is 'multi-factor authentication' (MFA) and why is it required by many service providers?
- Using multiple passwords for one account
- Requiring two or more verification factors (password + token/biometric) to authenticate users (Correct answer)
- Logging in from multiple devices simultaneously
- Using different passwords for each service
Correct answer: Requiring two or more verification factors (password + token/biometric) to authenticate users
MFA requires users to provide at least two independent verification factors, dramatically reducing the risk of unauthorized access even if a password is compromised.
Question 2: In a DDoS attack against a service provider's infrastructure, what is the primary defensive technique?
- Firewall rate limiting only
- DDoS scrubbing/mitigation centers that filter malicious traffic before it reaches the target (Correct answer)
- Powering off affected servers
- Redirecting all traffic to a backup ISP
Correct answer: DDoS scrubbing/mitigation centers that filter malicious traffic before it reaches the target
DDoS mitigation centers use traffic scrubbing to detect and filter attack traffic in real time, allowing legitimate traffic to reach the target while dropping malicious packets.
Question 3: What is 'vulnerability management' in a service provider operation?
- Managing customer complaints about product bugs
- The ongoing process of identifying, classifying, remediating, and reporting security vulnerabilities in systems (Correct answer)
- Documenting known network outages
- Patching only critical severity CVEs
Correct answer: The ongoing process of identifying, classifying, remediating, and reporting security vulnerabilities in systems
Vulnerability management is a continuous process that involves scanning systems for known weaknesses, prioritizing them by risk, and applying patches or mitigations in a timely manner.
Question 4: Under HIPAA, what obligation does a service provider acting as a 'Business Associate' have?
- Only to encrypt emails containing health data
- To sign a Business Associate Agreement and safeguard Protected Health Information (PHI) (Correct answer)
- To store patient records for 7 years
- To employ a licensed medical professional
Correct answer: To sign a Business Associate Agreement and safeguard Protected Health Information (PHI)
A Business Associate under HIPAA must sign a Business Associate Agreement (BAA) and implement appropriate safeguards to protect PHI on behalf of covered healthcare entities.
Question 5: What is the purpose of a SIEM (Security Information and Event Management) system?
- Store customer billing data securely
- Aggregate and analyze security logs from across infrastructure to detect threats in real time (Correct answer)
- Manage SSL certificate renewals
- Control physical access to data centers
Correct answer: Aggregate and analyze security logs from across infrastructure to detect threats in real time
A SIEM collects, correlates, and analyzes log data from network devices, servers, and applications to identify suspicious patterns and alert security teams.
Question 6: What does 'zero trust' security model mean for a service provider network?
- Blocking all external traffic by default
- Never implicitly trusting any user or device — always verify before granting access, regardless of location (Correct answer)
- Using zero-day exploits in penetration testing
- Eliminating all third-party vendor access
Correct answer: Never implicitly trusting any user or device — always verify before granting access, regardless of location
Zero trust assumes breach and requires continuous verification of every user and device attempting to access resources, eliminating the concept of a trusted internal network.
SP Security and Compliance 2
What is 'multi-factor authentication' (MFA) and why is it required by many service providers?