100-160 Question 6
Select 3An organization wants to implement a security strategy for its network infrastructure. The security team decides to apply the principles of 'least privilege' and 'defense in depth.' Which of the following actions align with these security principles?
- A
Grant users access only to the resources they need to perform their job functions.
- B
Deploy multiple layers of security controls, such as firewalls, intrusion detection systems, and endpoint protection.
- C
Provide all employees with administrative privileges to ensure they can troubleshoot issues independently.
- D
Rely solely on a single firewall for network protection to reduce complexity.
- E
Regularly review and update access permissions to ensure they align with job responsibilities.
Show answer and explanation
Correct answers: A, B, E
Explanation
The principles of 'least privilege' and 'defense in depth' are fundamental to cybersecurity. 'Least privilege' ensures users only have the minimum access necessary to perform their work, reducing risks of misuse. 'Defense in depth' employs multiple layers of security to protect against various threats, ensuring no single point of failure compromises the system. Correctly applying these principles strengthens an organization's overall security posture.
- A. Correct.
Granting users access only to the resources they need aligns with the principle of 'least privilege,' which minimizes the risk of unauthorized access or misuse.
- B. Correct.
Deploying multiple layers of security controls aligns with the principle of 'defense in depth,' ensuring that if one security layer is breached, others remain effective.
- C. Incorrect.
Providing all employees with administrative privileges violates the principle of 'least privilege,' as it unnecessarily increases the risk of privilege abuse or accidental system changes.
- D. Incorrect.
Relying solely on a single firewall for protection does not align with 'defense in depth,' as it introduces a single point of failure in the security strategy.
- E. Correct.
Regularly reviewing and updating access permissions ensures the principle of 'least privilege' is maintained over time, reducing the risk of unnecessary access.