Free Practice Quiz Question List

5 Secure Implementation and Configuration Online Quiz Questions

Use this free practice quiz with 20 questions to review 5 Secure Implementation and Configuration, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: Encrypting sensitive data removes the need to control which accounts or applications can access it.

A
True
B
False

Written response

1 point

What data-state term describes information while it is being processed?

Fill in the blank

1 point

A secure configuration baseline should be checked regularly for unauthorized changes or configuration .

Choose one

1 point

A new server needs a temporary build network before production deployment. Which configuration best limits its exposure while allowing setup to proceed?

A
Allow unrestricted access so the server can obtain any resources it might need.
B
Permit only the update and management traffic required for setup.
C
Expose the server to production networks before applying its baseline.
D
Disable all network controls until configuration is complete.

Choose one

1 point

An application lets users view orders. What control should it enforce to prevent a logged-in user from accessing another person's order?

A
Hide the order identifier in the page so the user cannot see it.
B
Allow access to any order if the user has successfully logged in.
C
Check that the user is authorized to access the specific order.
D
Rely on the user interface to prevent requests for other orders.

Choose all

1 point

An organization is setting a BYOD policy for devices that access corporate data. Which measures are appropriate? Select all that apply.

A
Separate work data from personal data where possible.
B
Assume the organization can erase any personal data without informing the user.
C
Clarify what the organization can manage or erase.
D
Limit access from devices that fail security checks.
E
Allow access from any device because it belongs to the employee.

True or false

1 point

True or false: In a zero-trust approach, being inside the corporate network is sufficient reason to grant access to a resource.

A
True
B
False

Written response

1 point

What security principle calls for granting people, services, and applications only the permissions needed for their required tasks?

Fill in the blank

1 point

A backup that has never been in a test may not be a reliable recovery path.

Choose all

1 point

An organization is preparing an embedded device for use. Which steps help reduce risks associated with device support and unnecessary access? Select all that apply.

A
Assess whether the device supports secure updates.
B
Keep default credentials if the device is placed on an internal network.
C
Change default credentials after acquisition.
D
Disable interfaces the device does not need.
E
Assume that a long service life means the manufacturer will provide updates.

Choose one

1 point

A team encrypts sensitive stored data. Which key-management practice best reduces the risk that an unauthorized person who obtains the data can also decrypt it?

A
Store the encryption keys alongside the data and grant the same broad access to both.
B
Protect encryption keys separately and restrict access to them.
C
Make the keys available to all users who can access any organizational file.
D
Use encryption only while data is moving, regardless of its sensitivity.

Choose one

1 point

A company wants to limit the impact of a compromised workstation on its servers. Which network design best supports that goal?

A
Place all devices on one network and rely only on a perimeter firewall.
B
Allow unrestricted communication between segments to simplify troubleshooting.
C
Separate systems by function and risk, permitting only required communication between segments.
D
Use network location as the sole basis for trusting requests.

Open ended

1 point

A building controller handles sensitive operational data, but its manufacturer does not provide a way to patch it. Describe what the organization should assess before acquisition and how it should reduce risk if the device cannot be adequately secured.

Written response

1 point

An application is processing a customer's sensitive information in memory. What data state describes that information?

Written response

1 point

A service removes optional personal-data fields from its sign-up form and deletes information it no longer needs. Which data-protection principle is it applying?

True or false

1 point

True or false: Encrypting sensitive data removes the need to control which accounts and applications can access it.

A
True
B
False

Choose one

1 point

A team has configured servers using an approved security baseline. Which practice best helps it identify unauthorized configuration changes over time?

A
Use the baseline only when initially building the system; later changes do not need review.
B
Compare the system's settings with the approved baseline regularly and investigate deviations.
C
Allow each administrator to change settings without recording them, as long as the system remains available.
D
Replace the baseline with endpoint protection software, which will prevent all configuration changes.

Choose one

1 point

Employees use personal phones to access company email and files. Which BYOD policy best protects organizational data while clarifying the effect of device management?

A
Allow access from any personal device and leave enrollment and security checks to the employee.
B
Require the organization to erase the entire device whenever it is lost, without explaining this in advance.
C
Separate work data from personal data where possible, clarify management or erasure, and restrict access from devices that fail security checks.
D
Permit access only if employees install applications from any source and disable device locks.

Choose one

1 point

A building controller has a known vulnerability, but its manufacturer no longer provides security updates. What is the most appropriate response?

A
Restrict the device's exposure or replace it if it cannot be adequately secured.
B
Connect it directly to the corporate network so it can receive more monitoring.
C
Keep all interfaces enabled so administrators can access it more easily.
D
Leave default credentials unchanged, since the device has a limited interface.

Choose one

1 point

An application lets users view orders by submitting an order identifier. What should it do to prevent one user from viewing another user's order?

A
Hide the order's identifier in the page so users cannot see it.
B
Check authorization only when the user first signs in, then trust all later requests.
C
Verify that the user is authorized to access the specific order whenever the sensitive action is requested.
D
Allow access if the user can guess or obtain the order's identifier.