Skip to content

D. Protection quiz

Read the examples first.

A platform team reviews its service accounts after 90 days. Which of the following findings must they act on under least privilege?

Select all that apply.

Show answer
  • Correct: The reporting service holds a database write permission it has not used in 90 days.. Right. P36 checks that no role holds a permission that was unused for a set period. Remove the write permission.
  • Incorrect: The billing service uses a role limited to read access on one table, and uses it daily.. This is what P36 asks for. The role is the minimum its function needs, and it is used. Nothing to change.
  • Correct: The deploy pipeline runs with cluster-admin rights but only ever updates one namespace.. Right. P36 gives each process only the access its function needs. Scope the pipeline to that namespace.
  • Incorrect: All services write their logs to an audit store that only the security team can read.. This is not a P36 finding. It limits who reads the logs, and no service holds more access than it needs.
  • Correct: An engineer keeps a standing admin role in case an incident happens one day.. Right. A permission held just in case is more than the function needs (P36). Grant it when needed, and remove it afterwards.
A finance director says all team leads should see every employee's salary data, so that they can plan budgets. Which of the following responses follow the management form of least privilege?

Select all that apply.

Show answer
  • Correct: Give each lead the budget and headcount of their own team only.. Right. P36 in its management form gives each person only the information their role needs.
  • Incorrect: Give all leads the HR export, because they are trusted people.. Wrong. Trust does not change need. Under P36 the question is what the role needs, and planning does not need salaries.
  • Incorrect: Require two signatures on every payment above a set amount.. A good control, but it is the two-person rule (P42) at the moment of payment. It does not limit what data a lead can see (P36).
  • Correct: Set a written spending limit for each lead, with higher amounts going up a level.. Right. Written limits of authority are part of P36 in its management form.
  • Incorrect: Remove the spending limits of senior leads to speed up decisions.. Wrong. P36 keeps decision authority at what the role needs. Speed is handled by deciding reversible things low (P18), not by removing limits.
An admission webhook that checks image signatures starts to error under load. The team must decide how it behaves when it fails. Which of the following choices follow fail-safe?

Select all that apply.

Show answer
  • Incorrect: Allow the request through, so that deployments never stall.. Wrong. This fails open and moves a security control to the dangerous state. P37 designs failure to move to the safe state.
  • Correct: Write down that the safe state is to reject, and test it by injecting a failure.. Right. P37 requires a defined safe state, and its check is a failure injection that shows the system reaches it.
  • Incorrect: Leave the behavior to the client library default, since nobody has tested what it does.. Wrong. Undefined behavior when a dependency is lost is the violation named in P37.
  • Correct: Reject the request while the webhook errors, and raise an alert.. Right. Rejecting is the defined safe state here, and the alert tells people the system is in it (P37).
  • Incorrect: Run a second copy of the same webhook against the same key service.. Wrong. Both copies share the key service, so one cause stops both (P46), and neither defines a safe state. Redundancy (P45) does not replace P37.
A company approves every production change through one change approver. The approver is often away. Which of the following defaults follow the management form of fail-safe?

Select all that apply.

Show answer
  • Incorrect: Any manager may approve by chat message while the approver is away.. Wrong. Failure moves to a dangerous state, since anyone can approve. P37 defines the fallback in advance.
  • Correct: No change goes ahead, and a named deputy can approve instead.. Right. P37 asks for a default option and a deputy, so absence moves the process to no change.
  • Incorrect: Leave the matter open and decide each time the approver is away.. Wrong. P37 defines what happens in advance. Deciding in the moment leaves the behavior undefined.
  • Incorrect: Require two approvers for every change, whoever is available.. Wrong. This is the two-person rule (P42), for critical irreversible actions. It does not say what happens when approvers are absent.
A review finds an admin port on a payment service that every office laptop can reach. A vendor tool needs the port in production, so it cannot be removed. Which of the following actions follow the hierarchy of controls?

Select all that apply.

Show answer
  • Incorrect: Add a README line that says do not connect to the admin port.. Wrong. A warning is the weakest kind of control. It is the violation named in P38 when it is the only control.
  • Correct: Bind the port to localhost, so only the vendor agent can reach it.. Right. This is an engineering control and acts at the source (P38). It does not depend on people.
  • Incorrect: Add a runbook step that tells operators to avoid the port.. Wrong. A runbook is an administrative control, and a higher level is possible here (P38).
  • Correct: Block the port with a policy rule and record why removal was not possible.. Right. P38 checks for a record that explains why a higher level was not possible. A policy engine is an engineering control.
An audit finds that staff share one login to a supplier portal. Which of the following responses follow the hierarchy of controls for management risks?

Select all that apply.

Show answer
  • Correct: Remove the shared account and give each person a personal login.. Right. Eliminating the risk is the highest level in P38. The shared credential no longer exists.
  • Incorrect: Publish a policy that says do not share credentials.. Wrong. A policy alone depends on people's behavior. P38 prefers removing shared accounts instead.
  • Incorrect: Run a yearly training session on password habits.. Wrong. Training is a low level in P38. It leaves the shared login in place.
  • Correct: Enforce single sign-on with multi-factor authentication, so sharing stops working.. Right. Single sign-on with a second factor ties each login to one person, which is how the shared account is removed in practice. It is system-enforced, so it does not rely on people's care (P38).
  • Incorrect: Keep one account, and let a vault hand out a credential to one named person at a time.. Wrong here. A vault is a lower level than removing the shared account, and removal is possible. P38 uses the highest possible level and records why a higher one was not possible.
A postmortem shows that three engineers ran a destructive migration against production when they meant to use staging. Which of the following fixes follow error-proofing?

Select all that apply.

Show answer
  • Incorrect: Send a reminder email every Monday that asks engineers to check the target.. Wrong. A reminder is the violation named in P39. It relies on memory and leaves the error possible.
  • Correct: Make the migration tool refuse a production target unless the command carries a change ticket number.. Right. P39 first tries to make the error impossible. A technical guard at that level satisfies the check.
  • Incorrect: Add a line about environments to the onboarding guide.. Wrong. Documentation does not stop a repeated error. P39 asks for a technical guard.
  • Incorrect: Add a dry-run mode that engineers may run if they remember to.. Wrong. An optional step is not a guard. P39 also prefers impossible over visible, and an impossible fix exists here.
A purchasing team keeps receiving orders with no contract number. Which of the following responses follow the management form of error-proofing?

Select all that apply.

Show answer
  • Correct: Make the contract number a required field, so the system refuses an order without one.. Right. P39 makes the error impossible in the process, so nobody has to catch it later.
  • Incorrect: Sample finished orders every month and chase the gaps by hand.. Wrong. This is inspection after the fact. P39 builds quality into the process instead of relying on it.
  • Correct: Reject any number that is not in the contract register.. Right. A system check on the value closes the gap that a required field leaves open (P39).
  • Incorrect: Train buyers on the importance of contract numbers.. Wrong. Training asks people not to err. P39 makes the error impossible instead.
  • Incorrect: Ask a second person to sign every order.. Wrong. The two-person rule (P42) is for critical, irreversible actions. A signature does not stop a missing number getting in.
A company stores customer records behind one perimeter firewall. Which of the following changes give it defense in depth?

Select all that apply.

Show answer
  • Incorrect: Add a second firewall of the same make and configuration at the same perimeter.. Wrong. The copy fails the same way as the first. P40 needs independent layers.
  • Correct: Add role-based access and a network policy, and test each layer every quarter.. Right. P40 checks for at least two independent layers per critical asset, each one verified.
  • Incorrect: Rely on the firewall, since the vendor rates it highly.. Wrong. Every single control fails at some point (P40). A rating is no substitute for layers.
  • Correct: Encrypt the data at rest and prove in a test that a copied disk is unreadable.. Right. Encryption is a layer independent of the firewall and the access roles, and the test verifies it (P40).
  • Incorrect: Add a third layer that nobody has tested.. Wrong. P40 requires each layer to be verified. An untested layer may not work when needed.
A company wants independent lines of defense over access to its production systems. Which of the following arrangements follow the management form of defense in depth?

Select all that apply.

Show answer
  • Correct: The platform team owns the access risk, security monitors it, and internal audit tests both.. Right. P40 in its management form uses three independent lines, owner, risk function and internal audit.
  • Incorrect: The platform team owns, monitors and audits its own access.. Wrong. One team in all three roles is one line, so one blind spot defeats all of it (P40).
  • Incorrect: Security owns the risk and also performs the internal audit of it.. Wrong. The auditor must be independent of the owner and of the risk function (P40).
  • Incorrect: Two platform engineers review each other's access.. Wrong. This is a peer check inside the first line (P56). It does not add independent lines.
A software-as-a-service product serves many customers from test, staging and production environments. Which of the following designs follow compartments?

Select all that apply.

Show answer
  • Correct: Run production and testing in separate cloud accounts.. Right. A separate account isolates one environment's failure from the others (P41).
  • Incorrect: Keep one shared database for all tenants and environments, and index it well.. Wrong. This is the violation named in P41. One bad query reaches every tenant.
  • Correct: Set quotas per namespace, so one runaway job cannot starve the rest.. Right. A quota contains the damage inside one compartment (P41).
  • Incorrect: Add a standby replica of the one shared database.. Wrong. A replica is redundancy (P45). Bad data written to the primary copies to the replica, so the failure still spreads.
  • Correct: Serve each group of customers from its own cell.. Right. Cell-based design lets one damaged cell fail alone. P41 checks that a failure test in one compartment leaves the rest working.
A company launches a risky new product beside its core business. Which of the following arrangements follow the management form of compartments?

Select all that apply.

Show answer
  • Incorrect: Fund the product from the core budget line, to keep accounts simple.. Wrong. A shared budget lets a failure spread to the core business. P41 separates budgets.
  • Correct: Give the product its own budget and written stop criteria.. Right. Ring-fencing is the management form of P41. The loss is capped at the product's budget.
  • Correct: Run the product as a separate legal entity.. Right. A separate entity is one way to keep a failure from spreading (P41).
  • Incorrect: Let the core team run both products with shared on-call and shared cash.. Wrong. Shared people and cash connect the two, so a failure spreads to the core business (P41). Fewer parts (P23) cannot justify removing every compartment.
A platform team lists the actions that may need a second approver. Which of the following actions fall under the two-person rule?

Select all that apply.

Show answer
  • Correct: Deleting production data after the backup window has passed.. Right. The action is critical and cannot be undone, so P42 requires two authorized people.
  • Incorrect: Editing a draft page on the team wiki.. Wrong. The action is neither critical nor irreversible. P42 does not apply.
  • Correct: Using break-glass access to production.. Right. P42 names break-glass access as a case for a live second approver.
  • Incorrect: Restarting a stateless service that has a one-click rollback.. Wrong. The action can be undone, so a second person would only add cost (P42).
  • Incorrect: Turning off a feature flag that can be switched back in seconds.. Wrong. It is reversible. Reversible decisions are made fast and low (P18), and P42 does not apply.
A company releases large payments from its bank account. Which of the following setups follow the management form of the two-person rule?

Select all that apply.

Show answer
  • Correct: A payment above a set amount needs two signatures when it is released.. Right. P42 requires two authorized people at the moment of action for critical irreversible actions.
  • Incorrect: The second signer approves the next day, after the money has left.. Wrong. P42 needs the second person at the moment of action, before the payment cannot be recalled.
  • Incorrect: One senior manager can release any payment alone, because they are trusted.. Wrong. P42 exists because one person can make an error or act with bad intent.
  • Incorrect: Two clerks sign, but both use one shared login.. Wrong. The system must enforce two distinct approvers (P42). A shared login is one person to the system.
  • Correct: A contract above a set value also needs two signatures.. Right. Contract signature is a named case of a critical, irreversible management action (P42).
A four-person team runs a cloud account that holds customer data, and the possible loss is above the acceptable risk. Which of the following arrangements satisfy segregation of duties?

Select all that apply.

Show answer
  • Correct: One engineer requests production access and another approves it.. Right. P43 splits the process so that nobody both requests and approves the same transaction.
  • Incorrect: Anyone may grant themselves admin rights, and the audit log lives in the same account.. Wrong. One person can grant rights and delete the log, which is the violation named in P43.
  • Correct: The one admin also executes and records changes, and a later independent review checks the log.. Right. Where the team is too small to split a step, P43 allows a compensating control, a later independent review.
  • Incorrect: Two admins share one password so that either can step in.. Wrong. Shared credentials remove the separation. The system cannot tell who acted (P43).
  • Incorrect: A quarterly access review that only looks for unused permissions.. Wrong. That is the check of least privilege (P36). P43 checks for people holding two incompatible roles.
A reviewer finds one person who raises purchase requests, approves them and records the payments. Which of the following fixes satisfy segregation of duties?

Select all that apply.

Show answer
  • Correct: Split request, approval, execution and recording across different people.. Right. P43 requires that no single person can do all of these steps on one transaction.
  • Incorrect: Require two signatures on the payment only.. Wrong. That is the two-person rule (P42) at the moment of payment. The same person still requests, approves and records.
  • Correct: Write a matrix of incompatible roles and review who holds two of them.. Right. The check in P43 is a matrix of incompatible roles plus an access review that finds nobody holding two.
  • Incorrect: Cut the person's permissions to what their job needs.. Wrong. Least privilege (P36) fits access to the job. If the job includes every step, the person still holds all of them (P43).
  • Correct: Add a later independent review where the team is too small to split a step.. Right. P43 allows a compensating control, a later independent review, in a very small team.