SNHD PROTOCOLS EXAM 2025 STUDY
GUIDE QUESTIONS AND SOLUTIONS 2026
CORRECT ANSWERS GRADED A+
⩥ Existing company policies specify the use of individual user accounts,
administrative accounts, and guest accounts, each with a different level
of access to internal resources.
Which information security principle justifies the company's use of
accounts with various access levels?
Authenticity
Possession
Least Privilege
Non-repudiation. Answer: Least Privilege
⩥ An organization's procedures document states that "All electronic
communications should be encrypted during transmission across
networks using encryption standards specified in the data encryption
policy."
Which security principle is this policy addressing?
,Availability
Confidentiality
Control
Interruption. Answer: Confidentiality
⩥ An organization sees an increase in recent operating system
vulnerabilities. To address these vulnerabilities, the organization
modifies its patching procedures to install critical security patches within
10 days of release.
Which defense in depth layer does the new policy address?
Data
Host
Network
Application. Answer: Host
⩥ A new software development company has determined that one of its
proprietary algorithms is at a high risk for unauthorized disclosure. The
company's security up to this point has been fairly lax.
Which procedure should the company implement to protect this asset?
, Transfer the algorithm onto servers in the demilitarized zone.
Relocate the algorithm to encrypted storage.
Store the algorithm on highly available servers.
Create multiple off-site backups of the algorithm.. Answer: Relocate the
algorithm to encrypted storage
⩥ An accounting firm stores financial data for many customers. The
company policy requires that employees only access data for customers
they are assigned to. The company implements a written policy
indicating an employee can be fired for violating this requirement.
Which type of control has the company implemented?
Preventative
Active
Deterrent
Detective. Answer: Deterrent
⩥ A company's incident response team (IRT) is reviewing a potential
malicious IP that was alerted through the SIEM tool.
This is an example of which step of the incident response process?
GUIDE QUESTIONS AND SOLUTIONS 2026
CORRECT ANSWERS GRADED A+
⩥ Existing company policies specify the use of individual user accounts,
administrative accounts, and guest accounts, each with a different level
of access to internal resources.
Which information security principle justifies the company's use of
accounts with various access levels?
Authenticity
Possession
Least Privilege
Non-repudiation. Answer: Least Privilege
⩥ An organization's procedures document states that "All electronic
communications should be encrypted during transmission across
networks using encryption standards specified in the data encryption
policy."
Which security principle is this policy addressing?
,Availability
Confidentiality
Control
Interruption. Answer: Confidentiality
⩥ An organization sees an increase in recent operating system
vulnerabilities. To address these vulnerabilities, the organization
modifies its patching procedures to install critical security patches within
10 days of release.
Which defense in depth layer does the new policy address?
Data
Host
Network
Application. Answer: Host
⩥ A new software development company has determined that one of its
proprietary algorithms is at a high risk for unauthorized disclosure. The
company's security up to this point has been fairly lax.
Which procedure should the company implement to protect this asset?
, Transfer the algorithm onto servers in the demilitarized zone.
Relocate the algorithm to encrypted storage.
Store the algorithm on highly available servers.
Create multiple off-site backups of the algorithm.. Answer: Relocate the
algorithm to encrypted storage
⩥ An accounting firm stores financial data for many customers. The
company policy requires that employees only access data for customers
they are assigned to. The company implements a written policy
indicating an employee can be fired for violating this requirement.
Which type of control has the company implemented?
Preventative
Active
Deterrent
Detective. Answer: Deterrent
⩥ A company's incident response team (IRT) is reviewing a potential
malicious IP that was alerted through the SIEM tool.
This is an example of which step of the incident response process?
