An organization ensures that users are granted access to only the data they need to perform specific work tasks. What principle are they following?

1. An organization ensures that users are granted access to only the data they need to perform specific work tasks. What principle are they following?

A. Principle of least permission
B. Separation of duties
C. Need to know
D. Role-based access control

2. An administrator is granting permissions to a database. What is the default level of access the administrator should grant to new users?
A. Read
B. Modify
C. Full access
D. No access

3. Why is separation of duties important for security purposes?
A. It ensures that multiple people can do the same job.
B. It prevents an organization from losing important information when they lose important people.
C. It prevents any single security person from being able to make major security changes without involving other individuals.
D. It helps employees concentrate their talents where they will be most useful.

4. What is a primary benefit of job rotation and separation of duties policies?

A. Preventing collusion

B. Preventing fraud

C. Encouraging collusion
D. Correcting incidents
5. A financial organization commonly has employees switch duty responsibilities every six months. What security principle are they employing?

A. Job rotation

B. Separation of duties

C. Mandatory vacations

D. Least privilege

6. Which of the following is one of the primary reasons an organization enforces a mandatory vacation policy?

A. To rotate job responsibilities
B. To detect fraud
C. To increase employee productivity

D. To reduce employee stress levels

7. An organization wants to reduce vulnerabilities against fraud from malicious employees. Of the following choices, what would help with this goal? (Choose all that apply.)
A. Job rotation
B. Separation of duties
C. Mandatory vacations
D. Baselining

8. Of the following choices, what is not a valid security practice related to special privileges?

A. Monitor special privilege assignments.

B. Grant access equally to administrators and operators.

C. Monitor special privilege usage.
D. Grant access to only trusted employees.
9. Which of the following identifies vendor responsibilities and can include monetary penalties if the vendor doesn’t meet the stated responsibilities?

A. Service level agreement (SLA)

B. Memorandum of understanding (MOU)

C. Interconnection security agreement (ISA)

D. Software as a Service (SaaS)

10. What should be done with equipment that is at the end of its life cycle and that is being donated to a charity?
A. Remove all CDs and DVDs.
B. Remove all software licenses.
C. Sanitize it.
D. Install the original software.