Question 330
A banking web app keeps sessions valid after user logout and password reset. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rotate and invalidate session identifiers at critical changes and enforce idle/absolute timeouts
- Set a longer session TTL after compromise
- Grant just-in-time elevation with approvals, short expiry and monitored sessions
- Hide the logout button but keep cookies active
Explanation
Correct Answer
A:Authentication ends only when active session authority is revoked.
Incorrect Answers
B:Longer validity increases exposure.
C:Time-limited rights reduce privilege exposure while preserving urgent access. Rotate and invalidate session identifiers at critical changes and enforce idle/absolute timeouts.
D:UI changes cannot revoke server sessions.
Question 331
Operations staff hold permanent global admin rights for occasional emergency maintenance. Which response best addresses the central security requirement with a defensible, risk-based design?
- Leave privileges permanently active and add log reviews
- Grant just-in-time elevation with approvals, short expiry and monitored sessions
- Share one emergency admin credential without expiry
- Use a governed privileged-credential vault with checkout, rotation and access logs
Explanation
Correct Answer
B:Time-limited rights reduce privilege exposure while preserving urgent access.
Incorrect Answers
A:Detective review does not remove standing access.
C:Shared rights defeat accountability.
D:Vaulting limits direct secret exposure and supports controlled usage. Grant just-in-time elevation with approvals, short expiry and monitored sessions.
Question 332
A maintenance team stores privileged database passwords in a shared spreadsheet. Which response best addresses the central security requirement with a defensible, risk-based design?
- Send passwords through unencrypted email after each change
- Encrypt the spreadsheet but share its decryption password broadly
- Use a governed privileged-credential vault with checkout, rotation and access logs
- Rotate and invalidate session identifiers at critical changes and enforce idle/absolute timeouts
Explanation
Correct Answer
C:Vaulting limits direct secret exposure and supports controlled usage.
Incorrect Answers
A:Insecure distribution defeats custody.
B:A shared key preserves broad disclosure.
D:Authentication ends only when active session authority is revoked. Use a governed privileged-credential vault with checkout, rotation and access logs.
Question 333
A remote onboarding portal registers privileged help-desk users from an unverified email address alone. Which response best addresses the central security requirement with a defensible, risk-based design?
- Deploy public-key passkeys with device/user verification and trusted origin binding
- Implement identity proofing appropriate to assurance level before binding credentials to the person
- Assume possession of a common email address proves legal identity
- Skip any identity check if the user knows the manager's name
Explanation
Correct Answer
B:Credential strength cannot repair a fraudulent identity claim.
Incorrect Answers
A:Passkeys avoid transmitting reusable passwords to the relying party. Implement identity proofing appropriate to assurance level before binding credentials to the person.
C:Mailboxes can be delegated or compromised.
D:Public biographical knowledge is not a proofing factor.
Question 334
A push-MFA system repeatedly prompts an employee until the user approves a fraudulent sign-in out of fatigue. Which response best addresses the central security requirement with a defensible, risk-based design?
- Increase the number of unsolicited push challenges
- Federate applications with a central identity provider and controlled sessions and logout
- Allow push approvals without user-initiated session context
- Adopt phishing-resistant or number-matched authentication and alert on abnormal push patterns
Explanation
Correct Answer
D:Repeated approval prompts can defeat simple push confirmation.
Incorrect Answers
A:More prompts amplify fatigue.
B:Single sign-on centralizes authentication lifecycle and policy enforcement. Adopt phishing-resistant or number-matched authentication and alert on abnormal push patterns.
C:Contextless approval cannot distinguish attack.
Question 335
After a prior passwordless finding, a regulated financial institution reports that the approved safeguard is implemented: “Deploy public-key passkeys with device/user verification and trusted origin binding.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Store one company-wide password in the browser
- Accept a signed change ticket saying: Deploy public-key passkeys with device/user verification and trusted origin binding
- Test login from a look-alike domain and verify the credential cannot authenticate
- Run this adjacent but different test as the sole proof: Request, exercise and expire a temporary privileged role in testing
Explanation
Correct Answer
C:Relying-party binding is the key security property.
Incorrect Answers
A:Shared credentials remain phishable. Test login from a look-alike domain and verify the credential cannot authenticate.
B:Test login from a look-alike domain and verify the credential cannot authenticate. Relying-party binding is the key security property.
D:Actual expiry validates JIT effectiveness. It tests jit, while this case requires evidence about passwordless.
Question 336
After a prior sso finding, a global logistics firm reports that the approved safeguard is implemented: “Federate applications with a central identity provider and controlled sessions and logout.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Disable an identity and verify downstream application sessions are invalidated as required
- Accept a signed change ticket saying: Federate applications with a central identity provider and controlled sessions and logout
- Use the completion of this alternative as proof: Give every application an identical local password
- Run this adjacent but different test as the sole proof: Request, exercise and expire a temporary privileged role in testing
Explanation
Correct Answer
A:End-to-end revocation tests centralized control.
Incorrect Answers
B:Disable an identity and verify downstream application sessions are invalidated as required. End-to-end revocation tests centralized control.
C:Shared secrets do not create centralized revocation. Disable an identity and verify downstream application sessions are invalidated as required.
D:Actual expiry validates JIT effectiveness. It tests jit, while this case requires evidence about sso.
Question 337
After a prior aaa finding, a regional hospital network reports that the approved safeguard is implemented: “Use an AAA architecture with separate authentication, authorization and accounting for privileged actions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Correlate named administrator authentication, privileges and command logs
- Use the completion of this alternative as proof: Enable only a shared password for all network devices
- Run this adjacent but different test as the sole proof: Request, exercise and expire a temporary privileged role in testing
- Accept a signed change ticket saying: Use an AAA architecture with separate authentication, authorization and accounting for privileged actions
Explanation
Correct Answer
A:Full AAA evidence proves accountability.
Incorrect Answers
B:Shared identity undermines accounting. Correlate named administrator authentication, privileges and command logs.
C:Actual expiry validates JIT effectiveness. It tests jit, while this case requires evidence about aaa.
D:Correlate named administrator authentication, privileges and command logs. Full AAA evidence proves accountability.
Question 338
A finance portal leaves fully privileged sessions active for days after users leave shared workstations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely only on browser window closing to revoke sessions
- Keep sessions active indefinitely so work is uninterrupted
- Apply appropriate idle and absolute session limits, secure revocation and reauthentication for sensitive actions
- Federate applications with a central identity provider and controlled sessions and logout
Explanation
Correct Answer
C:Session lifetime should align with misuse risk and user context.
Incorrect Answers
A:Server tokens can remain valid.
B:Persistent tokens prolong credential theft impact.
D:Single sign-on centralizes authentication lifecycle and policy enforcement. Apply appropriate idle and absolute session limits, secure revocation and reauthentication for sensitive actions.
Question 339
After a prior jit finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Grant just-in-time elevation with approvals, short expiry and monitored sessions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Leave privileges permanently active and add log reviews
- Request, exercise and expire a temporary privileged role in testing
- Run this adjacent but different test as the sole proof: Replay an old session cookie after logout and verify denial
- Accept a signed change ticket saying: Grant just-in-time elevation with approvals, short expiry and monitored sessions
Explanation
Correct Answer
B:Actual expiry validates JIT effectiveness.
Incorrect Answers
A:Detective review does not remove standing access. Request, exercise and expire a temporary privileged role in testing.
C:Server-side invalidation must be tested. It tests session management, while this case requires evidence about jit.
D:Request, exercise and expire a temporary privileged role in testing. Actual expiry validates JIT effectiveness.
Question 340
After a prior credential vault finding, an international retailer reports that the approved safeguard is implemented: “Use a governed privileged-credential vault with checkout, rotation and access logs.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Verify access logging, credential rotation and denied unauthorized checkout
- Use the completion of this alternative as proof: Encrypt the spreadsheet but share its decryption password broadly
- Run this adjacent but different test as the sole proof: Disable an identity and verify downstream application sessions are invalidated as required
- Accept a signed change ticket saying: Use a governed privileged-credential vault with checkout, rotation and access logs
Explanation
Correct Answer
A:Lifecycle evidence establishes vault enforcement.
Incorrect Answers
B:A shared key preserves broad disclosure. Verify access logging, credential rotation and denied unauthorized checkout.
C:End-to-end revocation tests centralized control. It tests sso, while this case requires evidence about credential vault.
D:Verify access logging, credential rotation and denied unauthorized checkout. Lifecycle evidence establishes vault enforcement.
Certified Information Systems Security Professional (CISSP) Practice Tests