Security Standards

1. A database storing user passwords was breached. The attacker finds that all passwords are stored as bcrypt hashes with unique salts. What does this storage method prevent, and why is it more secure than storing SHA-256 hashes without salt?

A. bcrypt prevents the attacker from reading the password file at all, since bcrypt is also an encryption algorithm B. Salting prevents rainbow table attacks (pre-computed hash lookup tables) since each password has a unique salt producing a unique hash; bcrypt is slow by design, making brute-force cracking orders of magnitude slower than SHA-256 C. bcrypt is a symmetric encryption algorithm that allows the passwords to be recovered by the security team after the breach D. Salting allows the system to verify passwords without hashing, making authentication faster and more secure

2. A government intelligence agency uses a system where user access is determined by security clearance labels (Top Secret, Secret, Unclassified) applied by the system administrator, and users cannot grant access to other users regardless of their own clearance level. Which access control model is this?

A. RBAC — access is based on the user's role (clearance level) in the organization B. DAC — the administrator exercises discretion in assigning access labels C. MAC — system-enforced labels determine access; users cannot override or grant access beyond their clearance; the system enforces the policy, not user discretion D. ABAC — multiple attributes including clearance, time, and location determine access

3. A plumber arrives to repair pipes in a corporate data center. The reception desk issues the plumber a visitor badge and has the facilities manager escort the plumber throughout the visit. Which physical security standard is being followed, and why is the escort requirement specifically necessary for visitors (not just employees)?

A. Physical security standard for contractors; escorts are required because contractors are untrusted and might steal equipment B. Visitor physical security standard; visitors are not vetted employees and must be escorted at all times in restricted areas — the escort takes responsibility for the visitor and ensures the visitor does not access unauthorized areas or equipment C. OSHA physical security requirement; all maintenance workers must be accompanied for safety reasons D. Visitor escort is optional; a temporary badge alone is sufficient physical security for visitors in any area

4. A company's encryption standard requires AES-256 for laptops and TLS 1.3 for web application traffic. Which data states do these requirements address, respectively?

A. AES-256 = data in use; TLS 1.3 = data at rest B. AES-256 on laptops = data at rest (stored data on disk); TLS 1.3 for web traffic = data in transit (data moving across the network) C. Both address data in transit; AES-256 encrypts the network tunnel and TLS handles authentication D. AES-256 = data in transit on internal networks; TLS 1.3 = data at rest in the database

5. An organization achieves ISO/IEC 27001 certification. What does this certification demonstrate, and how does ISO 27001 differ from NIST SP 800-53?

A. ISO 27001 certification means the organization has implemented every security control in existence; NIST 800-53 only applies to financial institutions B. ISO 27001 certification demonstrates that an independently audited information security management system meets an international standard; NIST 800-53 is a US government control catalog used for federal systems and FedRAMP, not an international certification C. ISO 27001 and NIST 800-53 are the same standard published under different names for different markets D. ISO 27001 only applies to European companies due to GDPR requirements

6. A company's access control standard requires that when an employee's contract ends, their system access is removed on the last day of employment. The HR department typically submits access removal requests 3–5 business days after the last day. What risk does this gap create, and what access control process should the standard specify?

A. The gap creates no risk; departed employees cannot access systems if they no longer have a building badge B. The 3-5 day gap leaves active credentials that the departed employee could use for unauthorized access or could be exploited by others who obtained those credentials; access removal must be immediate upon separation, not days later C. The gap is acceptable as long as the employee signed a non-disclosure agreement D. Access removal should happen 30 days after termination to allow for knowledge transfer

Matching: Access Control Models

Match each access control model (1–4) to its defining characteristic (A–D).

1MAC

2DAC

3RBAC

4ABAC

AAccess is determined by job function; users inherit permissions assigned to their position; most common enterprise model

BSystem enforces access based on classification labels; users cannot grant access beyond their clearance level; used in classified environments

CResource owner decides who can access their resources; typical of standard OS file permissions

DAccess decisions use multiple attributes simultaneously: user attributes, resource attributes, and environmental conditions like time and location

Security Standards — Quiz