Review questions

Review questions

Test your understanding with these questions. Marking and saved results are available with a free account.

1. Question 1A shared account mistakenly sent a payroll file. A manager asks to delete the log. What is the first professional action?

   Preserve restricted evidence, escalate through proper channels and contain sharing. Keep a team copy of the log and wait for the manager before disabling the link. Disable the link first, then purge the transfer log to reduce circulation of sensitive data.
2. Question 2A supplier report covers only a web app. Is it enough to connect an acquired network fully?

   Allow restricted connectivity because the web report has no findings, and inventory identity afterward. No; scope the report and assess identity, assets and flows before the owner's decision. Let the network operator accept the risk after documenting the rule; the vendor report defines the rest.
3. Question 3An alert appears at 09:00 and unauthorized access is confirmed at 12:00; a contract keys notice to confirmation. What record is needed?

   Automatically start the contractual clock at 09:00 as the most conservative interpretation. Record only 12:00 in the notice timeline because the contract uses confirmation as its trigger. A timeline distinguishing alert, confirmation and contract trigger interpretation.
4. Question 4Appointment booking can pause for a day, while dispensing medicine becomes unacceptable after four hours. Which initial business-impact priority fits?

   Prioritize dispensing, map its dependencies and recovery target with the owner, then sequence booking by impact. Recover booking first because it has more transactions, then map dispensing dependencies. Set the same four-hour target for both because they run on the same infrastructure.
5. Question 5A transferred employee retains an export privilege from an old role. What lifecycle action fits?

   Add the new role, then defer removal of the old export right to the quarterly review. Remove old rights and check conflicts, sessions and dependent accounts. Disable and recreate the account for the new role while keeping its old automation token for continuity.
6. Question 6In a file-upload system diagram, where is a key trust boundary before vendor scanning?

   Mark only browser-to-service; the vendor scan is an internal processing step that changes no data class. Draw a boundary only around the app server because the browser and vendor are outside the team’s ownership. Between browser and service, then service and vendor, showing data direction and identity.

Create a free account to mark your answers and save your progress.