CIS CIS Security & Compliance 1 — Questions and Answers
Question 1: In a CIS implementation, Role-Based Access Control (RBAC) is used to:
- Control which hardware resources are allocated to each server
- Grant system access based on a user's job function rather than individual identity (Correct answer)
- Encrypt data at rest
- Automate user provisioning via HR feeds
Correct answer: Grant system access based on a user's job function rather than individual identity
RBAC assigns permissions to roles (e.g., Admin, Editor, Viewer) and then assigns users to those roles, simplifying access management at scale.
Question 2: What is the principle of least privilege in CIS security design?
- All users get administrator access for convenience
- Users and systems are granted only the minimum access rights needed to perform their job (Correct answer)
- Privileged accounts are shared among team members
- Admin access is rotated on a weekly basis
Correct answer: Users and systems are granted only the minimum access rights needed to perform their job
The principle of least privilege limits user and system access to the minimum required, reducing the attack surface and potential damage from compromised accounts.
Question 3: Which US regulation governs the privacy and security of protected health information (PHI) that a CIS specialist must consider for healthcare implementations?
- SOX
- HIPAA (Correct answer)
- PCI DSS
- FERPA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) sets US federal standards for the privacy and security of protected health information in healthcare contexts.
Question 4: During a CIS implementation, a penetration test is conducted to:
- Measure system performance under load
- Simulate attacks to identify exploitable security vulnerabilities before go-live (Correct answer)
- Validate data migration accuracy
- Test user acceptance of the new interface
Correct answer: Simulate attacks to identify exploitable security vulnerabilities before go-live
Penetration testing involves authorized simulated attacks against the system to discover and fix security vulnerabilities before malicious actors can exploit them.
Question 5: What is multi-factor authentication (MFA) and why is it important in a CIS implementation?
- A method of backing up data to multiple locations
- An authentication process requiring two or more verification factors, increasing security beyond passwords alone (Correct answer)
- A technique for duplicating user accounts across systems
- A process for validating integration payloads
Correct answer: An authentication process requiring two or more verification factors, increasing security beyond passwords alone
MFA requires users to provide multiple forms of verification (e.g., password + SMS code), significantly reducing the risk of unauthorized access from stolen credentials.
Question 6: PCI DSS compliance is required for CIS implementations that involve:
- Student academic records
- Storage, processing, or transmission of payment card data (Correct answer)
- Healthcare patient records
- Government contractor data
Correct answer: Storage, processing, or transmission of payment card data
PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any system that stores, processes, or transmits cardholder data.
CIS CIS Security & Compliance 1
In a CIS implementation, Role-Based Access Control (RBAC) is used to: