MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

What is a third-party credential in cybersecurity?
a. A password created by the company’s IT team
b. A credential issued or managed by an external vendor
c. An internal employee’s account
d. A type of malware
Answer: b. A credential issued or managed by an external vendorupguard
Why are third-party credentials considered risky?
a. They are always weak
b. They can provide attackers with access to sensitive systems
c. They are rarely used
d. They use advanced encryption only
Answer: b. They can provide attackers with access to sensitive systemsupguard
What is the best practice for granting third-party access?
a. Grant full system access
b. Apply the principle of least privilege
c. Use default credentials
d. Allow account sharing
Answer: b. Apply the principle of least privilegesyteca
What security measure can enhance third-party account protection?
a. Disabling account expiration
b. Mandating two-factor authentication
c. Removing password requirements
d. Ignoring usage logs
Answer: b. Mandating two-factor authenticationsyteca+1
How often should third-party credentials be reviewed?
a. Never
b. Once a year
c. Regularly, as part of audits
d. Only after a security breach
Answer: c. Regularly, as part of auditsdeviceauthority+1
Which of the following is an example of a third-party?
a. Internal HR department
b. Cloud service provider
c. Full-time employee
d. On-site cleaner
Answer: b. Cloud service providersyteca+1
What is a common requirement in third-party agreements?
a. Unlimited access
b. Clear access scope and responsibilities
c. No cybersecurity consideration
d. Ignoring regulatory compliance
Answer: b. Clear access scope and responsibilitiessyteca
What can occur if third-party credentials are compromised?
a. Enhanced privacy
b. Unauthorized access to critical systems
c. Improved uptime
d. Faster patching
Answer: b. Unauthorized access to critical systemsupguard
Which is a mitigation step for third-party credential exposure?
a. Do not log access events
b. Implement account lockout policies
c. Share accounts among vendors
d. Ignore alerts
Answer: b. Implement account lockout policiesupguard
What should organizations do before providing third-party access?
a. Forego all approvals
b. Vet the vendor’s security practices
c. Provide default credentials
d. Ignore compliance
Answer: b. Vet the vendor’s security practicescisoshare+1
Which control is vital if a vendor requires privileged access?
a. No monitoring
b. Privileged Access Management (PAM)
c. Ignoring logs
d. Username hints on login
Answer: b. Privileged Access Management (PAM)syteca
Why avoid shared third-party accounts?
a. It is more expensive
b. Individual accountability is lost
c. It saves time
d. They offer better security
Answer: b. Individual accountability is lostcyberark
What must be done when a third-party contract ends?
a. Leave credentials active
b. Disable or revoke third-party credentials
c. Double vendor privileges
d. Extend remote access
Answer: b. Disable or revoke third-party credentialssyteca
What is an effective method to manage temporary vendor access?
a. Use permanent accounts
b. Provide time-limited credentials
c. Ignore audit trails
d. Share passwords
Answer: b. Provide time-limited credentialssyteca
What role does logging have in third-party credential management?
a. It’s not important
b. Helps detect unauthorized access
c. Only required for internal staff
d. Makes systems slower
Answer: b. Helps detect unauthorized accessdeviceauthority
What does a vendor management policy help define?
a. Internal employee salaries
b. Security requirements for third-party credentials
c. Project deadlines
d. Hardware inventory only
Answer: b. Security requirements for third-party credentialssyteca
After detecting suspicious third-party activity, what is the first response?
a. Ignore the alert
b. Investigate and suspend the affected credentials
c. Increase access levels
d. Announce via social media
Answer: b. Investigate and suspend the affected credentialsdeviceauthority+1
Which user authentication method can mitigate third-party risks?
a. Single sign-on with strong authentication
b. Default passwords
c. Manual login scripts
d. Shared spreadsheets
Answer: a. Single sign-on with strong authenticationdeviceauthority+1
Which standard access control policy applies to vendors?
a. Deny all access
b. Principle of least privilege
c. Open access
d. No access restriction
Answer: b. Principle of least privilegeaws.amazon+1
What is the role of contractual agreements in third-party credential management?
a. They set clear operational limits
b. They make access unlimited
c. They are unnecessary
d. They ensure vendor profitability only
Answer: a. They set clear operational limitssyteca
What should be monitored to avoid credential misuse?
a. File types
b. Access logs and usage patterns
c. Internet speed
d. Printer usage
Answer: b. Access logs and usage patternsdeviceauthority+1
What is a major compliance requirement for third-party access?
a. No documentation
b. Data protection and privacy obligations
c. Unlimited access for all
d. Vendor self-certification only
Answer: b. Data protection and privacy obligationscisoshare+1
Which tool can centralize the management of third-party credentials?
a. Manual tracking
b. Identity and Access Management (IAM) systems
c. Email forwarding
d. Sticky notes
Answer: b. Identity and Access Management (IAM) systemsaws.amazon
What is a best practice when onboarding a new vendor?
a. Give administrator access
b. Limit access and enforce authentication
c. Ignore onboarding procedures
d. No password required
Answer: b. Limit access and enforce authenticationupguard+1
How is credential rotation beneficial for vendors?
a. Reduces security
b. Minimizes the risk of compromise
c. Makes access easier
d. Slows down workflow
Answer: b. Minimizes the risk of compromisedeviceauthority+1
What should organizations do if a third-party vendor is breached?
a. Ignore event
b. Revoke access and rotate associated credentials
c. Send vendor an email
d. Lower monitoring
Answer: b. Revoke access and rotate associated credentialsupguard+1
What is one way to control third-party remote access?
a. Use firewalls and session monitoring
b. Enable access everywhere
c. Ignore activity logs
d. Disable encryption
Answer: a. Use firewalls and session monitoringcyberark
What information should contracts with third parties specify?
a. Security requirements for credentials
b. Social media accounts
c. Hardware used
d. Internal passwords
Answer: a. Security requirements for credentialssyteca
What makes frequent vendor credential review important?
a. Reduces workload
b. Identifies unused or risky credentials
c. Increases complexity
d. Avoids compliance
Answer: b. Identifies unused or risky credentialsdeviceauthority+1
Why are default credentials risky with third parties?
a. Always secure
b. Easy for attackers to guess
c. Require MFA
d. Need multi-user management
Answer: b. Easy for attackers to guessupguard
Which is a sign of poor third-party credential security?
a. Enforced password policies
b. Shared credentials and no monitoring
c. Timely privilege revocation
d. Session recording
Answer: b. Shared credentials and no monitoringcyberark
In a third-party risk assessment, what is prioritized?
a. Assessing critical vendors
b. Shortlisting only internal risks
c. Ignoring remote workers
d. Dropping security policies
Answer: a. Assessing critical vendorscisoshare
What is often included in service-level agreements with external vendors?
a. Credential management protocols
b. Free lunches
c. Staff onboarding
d. Software version lists
Answer: a. Credential management protocolssyteca
What is a vital step after terminating a third-party relationship?
a. No changes required
b. Immediate credential deactivation
c. Promoting vendor to admin
d. Extend contract
Answer: b. Immediate credential deactivationdeviceauthority+1
Who should be accountable for a third-party’s credential use?
a. No one
b. Named individuals or teams
c. The general public
d. Outsourced IT companies exclusively
Answer: b. Named individuals or teamsupguard+1
What can enforce time restrictions on third-party access?
a. Timed access credentials
b. Permanent access
c. Shared accounts
d. None of the above
Answer: a. Timed access credentialssyteca
How should organizations respond to lost third-party credentials?
a. Ignore the event
b. Invalidate and reset the credentials
c. Notify public
d. Change unrelated passwords
Answer: b. Invalidate and reset the credentialsdeviceauthority
How do you ensure least privilege for vendors?
a. No access limits
b. Specify minimum required permissions
c. Provide admin access automatically
d. Ignore user logs
Answer: b. Specify minimum required permissionsdeviceauthority+1
What’s an important regular task for third-party credential managers?
a. Holiday planning
b. Credential review and rotation
c. Ignoring vendor activity
d. Credential sharing
Answer: b. Credential review and rotationupguard+1
What risk does excessive third-party access create?
a. Zero-day exploits
b. Increased attack surface
c. Faster authentication
d. None
Answer: b. Increased attack surfacecyberark+1
Why use temporary credentials for third-party users?
a. Permanent access isn’t secure
b. Temporary credentials reduce exposure
c. Easier to share
d. Faster login
Answer: b. Temporary credentials reduce exposureaws.amazon+1
What’s a benefit of user education for third parties?
a. Better compliance
b. Ignoring policies
c. More credential sharing
d. Slower onboarding
Answer: a. Better compliancedeviceauthority
What should happen if a vendor’s employee departs?
a. All accesses remain open
b. Remove or update their credentials
c. Grant additional permissions
d. No change
Answer: b. Remove or update their credentialsupguard+1
How can session monitoring help with third-party risks?
a. Detects unauthorized activity
b. Slows down systems
c. Grants admin access
d. No effect
Answer: a. Detects unauthorized activitycyberark
What system helps enforce strong credential requirements for vendors?
a. IAM system with policy enforcement
b. Shared spreadsheets
c. Post-it notes
d. Closed source databases
Answer: a. IAM system with policy enforcementaws.amazon+1
What happens if third-party credentials are not deactivated?
a. Nothing
b. Lingering risk of unauthorized access
c. Improved productivity
d. Better compliance
Answer: b. Lingering risk of unauthorized accessdeviceauthority+1
When evaluating a new third-party service, what to check first?
a. Their reputation for credential management
b. Their logo design
c. Location of company
d. Social media presence
Answer: a. Their reputation for credential managementupguard+1
Which action can limit time-based risk with vendors?
a. Use credentials with expiration dates
b. Say “unlimited access” is ok
c. Never rotate passwords
d. Avoid record-keeping
Answer: a. Use credentials with expiration datesdeviceauthority+1
What’s a common requirement in regulated industries for vendor access?
a. Strict credential controls and documentation
b. Unlimited privileged access
c. Ignore all regulations
d. Use simple passwords only
Answer: a. Strict credential controls and documentationcisoshare+1
What should organizations do before granting vendor access?
a. Skip verification
b. Confirm necessity, vet vendor, and document details
c. Allow all vendors equal access
d. Let them self-register
Answer: b. Confirm necessity, vet vendor, and document detailscisoshare+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info