Fail-Safe Defaults

5 minutes 5 Questions

Fail-safe defaults refer to the practice of designing a system to operate securely by default, ensuring that if a failure or error occurs, the system reverts to a secure state. This means that permissions and access controls are set to the most restrictive settings by default, requiring explicit au…

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

Question 1

An organization's security policy mandates the use of fail-safe defaults for all new application deployments. One team is about to deploy a new web application. Which of the following options should they choose?

Disable all features and enable only those necessary for the application. Choose the default application configuration without any changes. Allow access to all application features for authenticated users. Enable all features and rely on the application's built-in security mechanisms.

Correct Answer: Disable all features and enable only those necessary for the application.

The principle of fail-safe defaults requires disabling all unnecessary features and enabling only those required for the application's functionality. This approach minimizes the attack surface and reduces the risk of unauthorized access. The other answers either do not adhere to the principle or do not specifically address the security concerns related to fail-safe defaults.

Question 2

A network administrator must block user access to the unused features of a router in order to follow the principle of fail-safe defaults. Which of the following practices should be implemented?

Enable all services on the router. Allow access to all features by default. Disable the unused services on the router. Limit user access through user accounts.

Correct Answer: Disable the unused services on the router.

The principle of fail-safe defaults requires that unused features or services should be disabled by default to minimize the attack surface. Disabling unused services on the router achieves this goal. The wrong answers would either not adhere to the principle, potentially increasing the risk, or not specifically address the need to block access to unused features.

Question 3

A security engineer is configuring a firewall with a fail-safe defaults policy. What should be the engineer's initial step?

Deny all traffic by default and create rules to allow specific traffic. Enable all firewall features and allow specific traffic. Create a custom rule to allow/deny traffic based on the company's security policy. Allow all traffic by default and create rules to deny specific traffic.

Correct Answer: Deny all traffic by default and create rules to allow specific traffic.

Following the principle of fail-safe defaults, a security engineer should deny all traffic by default and create rules to allow specific traffic as needed. This approach minimizes the attack surface by only allowing necessary traffic. The other answers do not adhere to the fail-safe defaults concept and could leave the network more vulnerable to attacks.

🎓 Unlock Premium Access

CompTIA Security+ + ALL Certifications

Fail-Safe Defaults

Guide to Fail-Safe Defaults

CompTIA Security+ - Fail-Safe Defaults Example Questions

Question 1

Question 2

Question 3

🎓 Unlock Premium Access