SP Security and Compliance 2

Question 1

What is 'multi-factor authentication' (MFA) and why is it required by many service providers?

Accepted Answer

Requiring two or more verification factors (password + token/biometric) to authenticate users

Answer

MFA requires users to provide at least two independent verification factors, dramatically reducing the risk of unauthorized access even if a password is compromised.

Question 2

In a DDoS attack against a service provider's infrastructure, what is the primary defensive technique?

Accepted Answer

DDoS scrubbing/mitigation centers that filter malicious traffic before it reaches the target

Answer

DDoS mitigation centers use traffic scrubbing to detect and filter attack traffic in real time, allowing legitimate traffic to reach the target while dropping malicious packets.

Question 3

What is 'vulnerability management' in a service provider operation?

Accepted Answer

The ongoing process of identifying, classifying, remediating, and reporting security vulnerabilities in systems

Answer

Vulnerability management is a continuous process that involves scanning systems for known weaknesses, prioritizing them by risk, and applying patches or mitigations in a timely manner.

Question 4

Under HIPAA, what obligation does a service provider acting as a 'Business Associate' have?

Accepted Answer

To sign a Business Associate Agreement and safeguard Protected Health Information (PHI)

Answer

A Business Associate under HIPAA must sign a Business Associate Agreement (BAA) and implement appropriate safeguards to protect PHI on behalf of covered healthcare entities.

Question 5

What is the purpose of a SIEM (Security Information and Event Management) system?

Accepted Answer

Aggregate and analyze security logs from across infrastructure to detect threats in real time

Answer

A SIEM collects, correlates, and analyzes log data from network devices, servers, and applications to identify suspicious patterns and alert security teams.

SP - Certified Service Provider Practice Test

SP - Certified Service Provider Practice Test

SP Security and Compliance 2