GSEC Practice Exam: Access Controls & Password Management Domain

Correct Answer: C

Explanation: Option C is correct because password managers help users generate and store complex, unique passwords securely, reducing the risk of password reuse and weak passwords. Option A is incorrect because password policies are still necessary to enforce security standards. Option B is incorrect as storing passwords in plain text is insecure. Option D is incorrect because while password managers can help mitigate some phishing risks, they do not prevent all types of phishing attacks.

Correct Answer: B

Explanation: Option B is correct because it directly specifies the requirement for a mix of character types in passwords, which enhances complexity and security. Option A, while promoting longer passwords, does not ensure character diversity. Option C relates to password expiration policies, not character requirements. Option D addresses password reuse but does not influence the character composition of passwords.

Correct Answer: C

Explanation: Implementing a temporary account lockout policy helps to prevent brute force attacks while allowing legitimate users to regain access after a short period. Option A, ignoring the attempts, could lead to a security breach. Option B, blocking the IP, might block legitimate users if it's a shared IP. Option D, increasing password complexity, does not address the immediate threat.

Correct Answer: A

Explanation: Implementing MFA adds an additional layer of security even if the password is weak, without requiring immediate changes to the password policy. Option B, enforcing a complex password policy, could be disruptive and lead to poor password practices. Option C, frequent password changes, can lead to poor password choices. Option D, disabling accounts immediately, could disrupt business operations.

Correct Answer: B

Explanation: Option B is correct because implementing role-based access control (RBAC) ensures that users only have access to the data necessary for their role, reducing the risk of unauthorized access to sensitive data. Option A is incorrect as default credentials pose a significant security risk. Option C is incorrect because disabling encryption compromises data confidentiality. Option D is incorrect as unrestricted access increases security risks and is contrary to the principle of least privilege.

Correct Answer: B

Explanation: Implementing RBAC ensures that users only have access to the resources necessary for their roles, minimizing security risks. Option A, using a single account, creates a single point of failure. Option C, allowing users to create policies, can lead to inconsistent and insecure configurations. Option D, a single policy for all, does not account for the principle of least privilege.

Correct Answer: B

Explanation: Changing the default passwords to strong, unique passwords immediately mitigates the risk of unauthorized access. Option A, disabling accounts, might disrupt legitimate use. Option C, blocking access, does not address the root cause and might block legitimate users. Option D, alerting users, delays the resolution of the risk.

Correct Answer: B

Explanation: Option B is correct because using multi-factor authentication (MFA) adds an additional layer of security, making it more difficult for unauthorized users to gain access to privileged accounts. Option A is incorrect as sharing credentials increases the risk of unauthorized access. Option C is incorrect because using privileged accounts for non-essential tasks increases exposure to threats. Option D is incorrect because disabling logging reduces the ability to audit and detect misuse of privileged accounts.

Correct Answer: B

Explanation: Option B is correct because implementing account lockout after a specified number of unsuccessful attempts directly mitigates brute force attacks by limiting the number of guesses an attacker can make. Option A, while helpful, primarily addresses issues with password aging rather than brute force attacks. Option C is a basic requirement but not sufficient on its own to prevent brute force attacks. Option D weakens security by allowing passwords to be reused too soon, which doesn't help against brute force attacks.

Correct Answer: B

Explanation: Enabling 2FA adds an additional layer of security to the password manager, ensuring that even if the master password is compromised, unauthorized access is still prevented. Option A is insecure as storing passwords in a document is risky. Option C increases the risk of exposure by sharing the master password. Option D is highly insecure, as it creates a single point of failure.