Security Analyst

Sample question 1

Bellwether Logistics deployed a cloud email security gateway to counter business email compromise, its highest-rated risk. Six months later, phishing-driven account compromises dropped from 40 per quarter to 3. All 3 remaining incidents were caught within an hour by the SOC's automated account-lockout playbook before any funds moved, and each involved one of a small group of executives who use a personal device that is not enrolled in the gateway. As the security analyst determining whether this deployment reduces the identified risk to an acceptable level, what should you conclude?

1. A.Conclude the risk remains unacceptable because incidents still occurred, and replace the gateway with a different vendor product immediately.
2. B.Conclude the risk is fully eliminated since incidents dropped sharply, and stop monitoring the gateway's effectiveness.
3. C.Conclude the determination must wait until a full year of data is collected before evaluating the gateway's effectiveness.
4. D.Conclude the residual risk is acceptable for now, since a compensating control catches remaining incidents before harm, and log the device gap.

Sample question 2

Harrier Underwriting's finance team has four staff, all cross trained to both create and approve wire transfers so the team can cover absences and vacations. There is no budget this year to add staff. Internal audit found two cases where the same employee created and approved the same wire transfer within minutes. The security analyst must recommend an access control addition that stops anyone from approving a transfer they created, while preserving every staff member's ability to perform either duty on other transfers. Which addition should the analyst recommend?

1. A.Enforce static separation of duty by assigning the create and approve permissions to mutually exclusive finance roles.
2. B.Add a dynamic separation of duty constraint: a transfer's creator cannot approve that same transfer but keeps both permissions.
3. C.Apply attribute based rules that block approvals outside business hours and above each employee's individual transaction limit.
4. D.Restructure approvals into a role hierarchy where a senior approver role inherits the junior creators' permissions downward.

Sample question 3

Fatima, a security analyst preparing a customer for a SOC 2 Type II examination, is reviewing the customer's identity and access management program. The customer's ERP system grants access purely through static job-title roles: every Accounts Payable Clerk receives identical permissions regardless of their device's patch status, working hours, or the sensitivity of the specific vendor records they touch. The examiner's draft finding requires that access decisions incorporate contextual risk factors, such as device compliance state and record sensitivity, without the business creating a new named role for every possible combination. Which remediation should Fatima recommend?

1. A.Increase the granularity of the ERP's existing role hierarchy so that clerks are split into additional roles reflecting differences in device patch status, working hours, and vendor record sensitivity, then have identity management reassign each affected clerk to the role that matches their current profile.
2. B.Adopt policy-based access controls that evaluate rules combining the clerk's attributes, the device's compliance posture, and the vendor record's sensitivity at the moment of each access request, granting or denying access dynamically from that real-time evaluation of context.
3. C.Retire the standing role assignments entirely and require a manager-approved request form to be filed and reviewed before each vendor record is opened, so that every access decision becomes a one-off manual approval rather than a standing, rule-based grant.
4. D.Layer conditional access policies onto the ERP so that every sign-in requires multi-factor authentication and is denied whenever the device fails its current patch-compliance check, bringing the device's real-time risk posture into each authentication decision for all clerks.