Information Security Management Examination (SG) | Section A Questions on Zero Trust, Data Protection, and Security Operations 11

Risk-based authentication uses information such as IP address, location, time, device or browser state, and deviation from previous behavior when making an authentication decision. Several anomalies coincide here, so step-up authentication or denial with monitoring is appropriate. Treating every request identically or evaluating the context only after access has been granted does not adapt authentication to risk.

Zero trust does not grant implicit trust merely because a request originates on an internal network. It dynamically evaluates the user, device health, requested resource, and environment, grants least privilege for each session, and monitors changing conditions. Zero trust does not mean denying everything; it means granting an appropriate scope of access to a verified request.

A quarantine network separates an unverified or noncompliant device from the business network while providing only the limited communication needed for inspection and patching. Reassessing the device after remediation helps prevent a vulnerable endpoint from spreading a compromise. Isolation without a remediation path or a decision to readmit the device is an incomplete quarantine process.

The test requires the display format, not actual customer values. Data masking replaces original values with redacted or format-compatible fictitious values, reducing developers' exposure to real data. If the transformation is reversible and uses a mapping table, that table and the reidentification privilege also require protection. A warning alone does not reduce the risk created by copying production data.

Cryptographic erase appropriately sanitizes the keys needed to decrypt ciphertext, making permanent decryption of the target data infeasible. The relevant conditions are full-storage encryption, no plaintext history, and no key copies. If a key remains elsewhere or some area was previously stored in plaintext, the same assurance is not available and another sanitization method suitable for the medium and risk should be considered.

An IPS adds the ability to attempt to stop suspicious traffic to intrusion-detection capabilities, so it fits an inline automatic-blocking requirement. An IDS primarily detects, reports, and records; a monitoring-only IDS does not itself block traffic. Because IPS false positives can affect availability, rule testing, staged deployment, exception management, and monitoring are necessary.

Because a honeypot has no legitimate users or business purpose, access to it can provide evidence of suspicious activity and attack techniques. A decoy that is expected to be attacked must be isolated so that it cannot become a pivot into other systems and must be monitored by qualified personnel. A honeypot supplements rather than replaces IDS, IPS, and access controls.

Comparing actual configurations with a baseline identifies configuration drift caused by unauthorized changes or misconfiguration. After detecting a deviation, the organization should examine authorization, security impact, and cause and then remediate it. A legitimate change can be reflected in a new baseline after the required approval and testing, so every difference is not necessarily reverted mechanically to an old setting.

An emergency process can use a shorter approval path to respond quickly, but it does not eliminate change control. The authorized person, target, impact, and rollback method should be checked, and implementation and results should be recorded. A post-change review evaluates effectiveness and side effects, and a setting that remains in use is incorporated into the approved baseline to preserve traceability.

Data minimization and life-cycle management limit storage to the scope and duration needed for the purpose and address copies according to policy when that period ends. Since there is no retention obligation or hold here, the organization should locate and delete or dispose of the data and record the result. When a legal or investigative retention need exists, its scope and duration should be documented as an exception and protected accordingly.