CAS-003 · Question #703
A security analyst has received the following requirements for the implementation of enterprise credential management software. - The software must have traceability back to an individual…
The correct answer is B. Credentials stored, hashed, and salted on each local machine. The critical requirement that eliminates most choices is: 'Credentials must remain unknown to the vendor at all times.' Options A and C store credentials in a vendor's cloud, meaning the vendor infrastructure handles them - even with encryption in transit, the vendor could…
Question
A security analyst has received the following requirements for the implementation of enterprise credential management software.
- The software must have traceability back to an individual
- Credentials must remain unknown to the vendor at all times
- There must be forced credential changes upon ID checkout
- Complexity requirements must be enforced.
- The software must be quickly and easily scalable with max mum availability
Which of the following vendor configurations would BEST meet these requirements?
Options
- ACredentials encrypted in transit and then stored, hashed and salted in a vendor's cloud, where the
- BCredentials stored, hashed, and salted on each local machine
- CCredentials encrypted in transit and stored in a vendor's cloud, where the enterprise retains the
- DCredentials encrypted in transit and stored on an internal network server with backups that are
How the community answered
(58 responses)- A33% (19)
- B45% (26)
- C16% (9)
- D7% (4)
Explanation
The critical requirement that eliminates most choices is: 'Credentials must remain unknown to the vendor at all times.' Options A and C store credentials in a vendor's cloud, meaning the vendor infrastructure handles them - even with encryption in transit, the vendor could potentially access them unless the enterprise holds the decryption keys (C is truncated but likely describes this). Option D stores on an internal server, which is closer but involves backup complexity. Option B stores credentials hashed and salted on each local machine - the vendor never has custody of the credentials at any stage, fully satisfying the vendor-unknowing requirement. The tradeoff is that local storage has scalability limitations for large enterprises, but among the given options, B is the only one that categorically prevents vendor access.
Topics
Community Discussion
No community discussion yet for this question.