IncludeHelp_logo
Skip Navigation Links
×

Trending Technologies MCQs

Home » Trending Technologies MCQs

Continuous Authentication MCQs (Multiple-Choice Questions)

Continuous Authentication is a security approach that repeatedly evaluates whether a user or device should remain trusted throughout an active session. Instead of relying exclusively on the initial login, it uses signals such as device characteristics, user behavior, location, and access patterns to identify suspicious activity. These Continuous Authentication MCQs help learners understand adaptive verification, behavioral biometrics, risk scoring, session security, and modern identity protection techniques.

Continuous Authentication MCQs

Traditional authentication typically verifies a user's identity when a session begins. However, a session may become risky after login if a device is compromised, credentials are stolen, or an unauthorized person takes control of an active session. Continuous Authentication helps address this limitation by reassessing relevant signals during the session and responding when the risk changes.

Practicing these multiple-choice questions helps students, cybersecurity professionals, developers, and IT administrators understand how continuous verification differs from conventional login procedures. The questions cover behavioral analysis, contextual signals, risk-based authentication, session monitoring, device posture, anomaly detection, privacy, and practical security scenarios.

List of Continuous Authentication MCQs

The following questions cover Continuous Authentication fundamentals, behavioral biometrics, contextual signals, adaptive authentication, risk scoring, session revocation, device trust, anomaly detection, Zero Trust principles, machine learning, false positives, privacy safeguards, and real-world implementation. Each question includes four options, the correct answer, and an explanation.

1. What is the primary purpose of Continuous Authentication?

  1. To eliminate all user identity checks
  2. To verify a user's identity only when creating an account
  3. To repeatedly evaluate identity and session risk during an active session
  4. To grant permanent access after the first login

Answer: C) To repeatedly evaluate identity and session risk during an active session

Explanation:

Continuous Authentication evaluates relevant identity and contextual signals throughout a session. When the observed risk changes, the system may request additional verification, restrict access, or terminate the session.

2. How does Continuous Authentication differ from traditional authentication?

  1. It can reassess trust after the initial login instead of relying only on the initial verification
  2. It never verifies the user's identity
  3. It always requires a new password every second
  4. It removes authorization checks from applications

Answer: A) It can reassess trust after the initial login instead of relying only on the initial verification

Explanation:

Traditional authentication often focuses on establishing identity at login. Continuous Authentication supplements that initial check by evaluating new signals or events while the session remains active.

3. Which of the following is an example of a behavioral biometric signal?

  1. A user's office building number
  2. The color of a computer monitor
  3. The size of a downloaded file
  4. A user's typing rhythm and keystroke timing

Answer: D) A user's typing rhythm and keystroke timing

Explanation:

Behavioral biometrics analyze patterns in how a person performs actions, such as typing rhythm, mouse movement, or touchscreen gestures. These patterns can help estimate whether the current session is consistent with the legitimate user.

4. What is the main purpose of risk-based authentication?

  1. To assign every user the same permissions
  2. To adjust authentication requirements according to the assessed risk of a request
  3. To permanently disable multifactor authentication
  4. To allow every sign-in from an unfamiliar device

Answer: B) To adjust authentication requirements according to the assessed risk of a request

Explanation:

Risk-based authentication considers contextual signals and observed behavior to determine the appropriate response. A low-risk event may proceed normally, while a high-risk event may require stronger verification or be denied.

5. Which signal can help a Continuous Authentication system identify a potentially suspicious session?

  1. An unexpected change in device or session characteristics
  2. The use of an approved application under normal conditions
  3. A successful routine access review
  4. A scheduled system backup

Answer: A) An unexpected change in device or session characteristics

Explanation:

Unusual changes in device state, network context, location, or interaction patterns can indicate increased risk. A system should evaluate these signals alongside other evidence rather than automatically treating every change as an attack.

6. What does behavioral profiling mean in Continuous Authentication?

  1. Assigning users permanent administrator privileges
  2. Recording passwords in a shared document
  3. Establishing and evaluating patterns of user behavior to identify unusual activity
  4. Disabling all user activity monitoring

Answer: C) Establishing and evaluating patterns of user behavior to identify unusual activity

Explanation:

Behavioral profiling compares current activity with relevant patterns or models of expected behavior. Deviations can trigger further investigation or authentication, although legitimate changes in behavior must also be considered.

7. Which technology can help analyze unusual user activity in a Continuous Authentication system?

  1. File compression alone
  2. Machine learning and anomaly detection
  3. Screen resolution adjustment
  4. Static website formatting

Answer: B) Machine learning and anomaly detection

Explanation:

Machine learning and anomaly detection techniques can identify deviations in user behavior, device characteristics, and access patterns. Their effectiveness depends on data quality, suitable models, and appropriate handling of false positives.

8. What is step-up authentication?

  1. Removing all security checks after login
  2. Granting higher privileges whenever a user changes location
  3. Using only a username for sensitive operations
  4. Requesting stronger verification when risk or resource sensitivity requires it

Answer: D) Requesting stronger verification when risk or resource sensitivity requires it

Explanation:

Step-up authentication introduces an additional or stronger verification requirement when a user attempts a sensitive operation or a risk signal changes. It allows the system to apply stronger controls without necessarily interrupting every routine action.

9. Which principle is closely associated with Continuous Authentication in modern security architectures?

  1. Trust every user inside the corporate network
  2. Grant unrestricted access after one successful login
  3. Continuously evaluate trust and enforce access according to policy
  4. Disable verification for internal applications

Answer: C) Continuously evaluate trust and enforce access according to policy

Explanation:

Continuous Authentication supports Zero Trust approaches by providing updated evidence about identity and session risk. Access decisions should still consider authorization policies, resource sensitivity, and other relevant controls.

10. What is the purpose of device posture assessment?

  1. To evaluate whether a device meets required security conditions
  2. To determine a user's favorite application color
  3. To automatically assign root access to the device owner
  4. To replace all identity verification methods

Answer: A) To evaluate whether a device meets required security conditions

Explanation:

Device posture assessment may examine patch status, endpoint protection, encryption, configuration, and device management status. A device that no longer meets security requirements may trigger restricted access or additional verification.

11. Which authentication signal is based on physical or behavioral characteristics of an individual?

  1. IP address allocation
  2. Biometric information
  3. File extension
  4. Network bandwidth

Answer: B) Biometric information

Explanation:

Biometric signals can include physical characteristics, such as fingerprints or facial features, and behavioral characteristics, such as typing patterns. Biometric processing requires appropriate privacy protections and should account for accuracy limitations.

12. What is a false positive in Continuous Authentication?

  1. An attack that is always detected correctly
  2. A valid session that is permanently trusted
  3. A security alert generated after a confirmed malicious action
  4. Legitimate user activity incorrectly classified as suspicious

Answer: D) Legitimate user activity incorrectly classified as suspicious

Explanation:

A false positive occurs when normal activity is mistakenly flagged as risky. Excessive false positives can interrupt work and cause users to distrust security controls, so detection thresholds require careful tuning.

13. What is a false negative in an authentication risk detection system?

  1. Malicious or risky activity that the system incorrectly treats as legitimate
  2. A legitimate login that triggers a warning
  3. A user who successfully completes multifactor authentication
  4. A device that passes a security compliance check

Answer: A) Malicious or risky activity that the system incorrectly treats as legitimate

Explanation:

A false negative occurs when a system fails to recognize suspicious activity. It can allow an attacker to continue using a session, making detection quality and complementary security controls important.

14. Why is session revocation important in Continuous Authentication?

  1. It makes all authentication tokens permanent
  2. It removes the need to assess suspicious behavior
  3. It allows a system to invalidate access when a session is no longer trusted
  4. It automatically grants the user more permissions

Answer: C) It allows a system to invalidate access when a session is no longer trusted

Explanation:

Session revocation can terminate or invalidate an active session after a compromise, policy violation, or high-risk event. Its effectiveness depends on how quickly the application, identity provider, and relevant services enforce the revocation.

15. Which type of information can be used as a contextual signal for Continuous Authentication?

  1. The user's favorite movie
  2. Login location, device information, and time of access
  3. The color of the application's logo
  4. The number of letters in the user's display name

Answer: B) Login location, device information, and time of access

Explanation:

Contextual signals describe the circumstances surrounding an access request. Location, device posture, network conditions, time, and resource sensitivity may help determine whether a session requires additional security checks.

16. What is the main advantage of adaptive authentication?

  1. It removes all authentication requirements for trusted users
  2. It permanently assigns the same risk score to every user
  3. It prevents every legitimate user from changing devices
  4. It adjusts verification requirements according to risk and context

Answer: D) It adjusts verification requirements according to risk and context

Explanation:

Adaptive authentication responds to changing circumstances instead of applying identical verification requirements to every request. It may require stronger authentication when unusual activity or sensitive operations increase the risk.

17. Why might a Continuous Authentication system monitor typing rhythm?

  1. To estimate whether current typing behavior matches the expected user pattern
  2. To determine the user's computer brand with certainty
  3. To replace all authorization policies
  4. To generate a permanent password from each keystroke

Answer: A) To estimate whether current typing behavior matches the expected user pattern

Explanation:

Keystroke dynamics can measure timing patterns, such as key dwell time and intervals between keystrokes. These signals can contribute to a behavioral risk assessment but should not be treated as infallible proof of identity.

18. Which challenge can arise when implementing Continuous Authentication across different devices?

  1. All devices always produce identical behavioral signals
  2. Device differences can change normal behavior patterns and affect detection accuracy
  3. Continuous Authentication cannot evaluate device information
  4. Different devices eliminate the possibility of false positives

Answer: B) Device differences can change normal behavior patterns and affect detection accuracy

Explanation:

Typing patterns, pointer behavior, and device characteristics can vary between a desktop, tablet, and smartphone. Systems must account for legitimate variation to avoid misclassifying normal users as suspicious.

19. What does continuous session monitoring typically involve?

  1. Checking only whether the user has selected a profile picture
  2. Disabling access logs after the first login
  3. Collecting and evaluating relevant events and signals while a session is active
  4. Granting access permanently once a session begins

Answer: C) Collecting and evaluating relevant events and signals while a session is active

Explanation:

Continuous session monitoring evaluates relevant changes and events throughout an active session. Depending on the system, it may detect unusual requests, device changes, policy violations, or patterns associated with account compromise.

20. Which action may be appropriate when a session's risk score becomes critically high?

  1. Automatically grant administrative privileges
  2. Ignore the score under every circumstance
  3. Disable security logging to avoid generating alerts
  4. Require stronger verification, restrict access, or terminate the session according to policy

Answer: D) Require stronger verification, restrict access, or terminate the session according to policy

Explanation:

A high risk score can trigger a predefined response. The correct action depends on the severity of the signal, resource sensitivity, and organizational policy, and should be proportionate to the assessed risk.

21. What is a risk score in Continuous Authentication?

  1. A numerical or categorical estimate of the risk associated with a user, device, or access event
  2. A permanent password assigned to an account
  3. A measure of how quickly a computer starts
  4. A guaranteed prediction that an attack will occur

Answer: A) A numerical or categorical estimate of the risk associated with a user, device, or access event

Explanation:

A risk score summarizes evidence from relevant signals to support access decisions. It is an estimate rather than certainty, and its usefulness depends on signal quality, model calibration, and appropriate response policies.

22. Which factor can increase the risk of session hijacking?

  1. Using short-lived sessions where appropriate
  2. Protecting session cookies with suitable security attributes
  3. Exposure or theft of a valid session token
  4. Requiring reauthentication for sensitive operations

Answer: C) Exposure or theft of a valid session token

Explanation:

An attacker who obtains a valid session token may be able to impersonate the authenticated user. Secure token storage, transport protection, appropriate cookie settings, session expiration, and risk monitoring help reduce this threat.

23. How can Continuous Authentication support protection against session hijacking?

  1. By making every session token publicly accessible
  2. By detecting suspicious changes in behavior or session context and triggering an appropriate response
  3. By disabling all session expiration policies
  4. By granting every session permanent trust

Answer: B) By detecting suspicious changes in behavior or session context and triggering an appropriate response

Explanation:

Continuous Authentication can identify signals inconsistent with the expected session and prompt further verification or revoke access. It supplements rather than replaces secure session management and token protection.

24. Why is user consent and transparency important when collecting behavioral authentication data?

  1. They guarantee that every detection model is accurate
  2. They eliminate all security risks
  3. They make access control policies unnecessary
  4. They help users understand data collection and support appropriate privacy practices

Answer: D) They help users understand data collection and support appropriate privacy practices

Explanation:

Behavioral monitoring may involve sensitive information about user interactions. Transparency, data minimization, appropriate legal grounds or consent where required, access controls, and retention limits help protect privacy and maintain trust.

25. Which approach can reduce unnecessary interruptions caused by Continuous Authentication?

  1. Using calibrated risk thresholds and requiring additional verification when justified
  2. Prompting for a password after every keystroke
  3. Blocking all users who change locations
  4. Ignoring all risk signals

Answer: A) Using calibrated risk thresholds and requiring additional verification when justified

Explanation:

Well-calibrated policies balance security and usability. Systems can allow low-risk activity to continue while applying step-up verification or restrictions to events that indicate meaningful risk.

26. What is the purpose of anomaly detection in Continuous Authentication?

  1. To guarantee that all user behavior remains unchanged
  2. To eliminate the need for security event logs
  3. To identify patterns that differ significantly from expected behavior or established baselines
  4. To grant elevated privileges whenever an anomaly occurs

Answer: C) To identify patterns that differ significantly from expected behavior or established baselines

Explanation:

Anomaly detection identifies unusual activity that may indicate misuse, compromise, or an unexpected change. An anomaly is not necessarily malicious, so systems should consider context and the potential for false positives.

27. Which statement about geolocation as an authentication signal is correct?

  1. A location signal always proves the identity of the user
  2. Location can provide useful context but may be inaccurate, spoofed, or affected by network routing
  3. Location makes multifactor authentication unnecessary
  4. Every location change must indicate an attack

Answer: B) Location can provide useful context but may be inaccurate, spoofed, or affected by network routing

Explanation:

Geolocation can contribute to a risk assessment, but IP-based location may be imprecise and VPNs or mobile networks can alter apparent location. It should be combined with other signals rather than used as definitive proof of identity.

28. What is the primary purpose of reauthentication during an active session?

  1. To create a new user account every time
  2. To disable the user's existing permissions permanently
  3. To eliminate all session monitoring
  4. To verify the user's identity again before continuing or performing a sensitive action

Answer: D) To verify the user's identity again before continuing or performing a sensitive action

Explanation:

Reauthentication requests fresh evidence of identity when risk, elapsed time, or resource sensitivity justifies it. It can help reduce the impact of unattended devices or compromised active sessions.

29. Which type of event may justify step-up authentication for a user who is already signed in?

  1. An attempt to transfer a large amount of sensitive data that exceeds normal patterns
  2. Opening an ordinary page that the user routinely accesses
  3. Viewing a standard help article
  4. Changing the display theme from light to dark

Answer: A) An attempt to transfer a large amount of sensitive data that exceeds normal patterns

Explanation:

An unusual attempt to access or transfer sensitive information may indicate elevated risk. The application can request stronger verification, apply additional authorization checks, or restrict the operation based on policy.

30. What is the role of a security baseline in behavioral authentication?

  1. It assigns all users identical behavioral profiles
  2. It stores every user's password for comparison
  3. It provides a reference for comparing current activity with expected patterns
  4. It prevents users from changing their normal work habits

Answer: C) It provides a reference for comparing current activity with expected patterns

Explanation:

A behavioral baseline represents expected activity for an identity or group under relevant conditions. Comparing current behavior with that baseline can help identify unusual events, but baselines must adapt carefully to legitimate changes.

31. Why should Continuous Authentication systems avoid relying on a single risk signal?

  1. A single signal always provides complete identity proof
  2. Individual signals can be inaccurate or misleading, so combining relevant evidence can improve decisions
  3. Multiple signals automatically eliminate privacy concerns
  4. Every additional signal guarantees a correct result

Answer: B) Individual signals can be inaccurate or misleading, so combining relevant evidence can improve decisions

Explanation:

A single signal, such as location or typing behavior, can be affected by legitimate circumstances or manipulated by attackers. Combining independent, relevant signals can improve assessment, although excessive collection and poorly calibrated models introduce other risks.

32. What is a potential limitation of behavioral biometrics?

  1. They can never be used during an active session
  2. They always require a traditional password
  3. They cannot generate any information about user behavior
  4. Legitimate behavior may change because of fatigue, injury, accessibility needs, or a different device

Answer: D) Legitimate behavior may change because of fatigue, injury, accessibility needs, or a different device

Explanation:

Behavioral patterns are not perfectly stable. Changes in physical condition, work context, assistive technology, or devices may cause legitimate activity to appear unusual, so authentication systems need careful calibration and alternative verification paths.

33. Which security practice helps protect data collected by a Continuous Authentication system?

  1. Collecting only necessary data, restricting access, and applying suitable retention controls
  2. Publishing behavioral profiles to all employees
  3. Storing sensitive information without access restrictions
  4. Retaining every collected signal forever without review

Answer: A) Collecting only necessary data, restricting access, and applying suitable retention controls

Explanation:

Authentication telemetry can contain sensitive personal and behavioral information. Data minimization, access restrictions, secure storage, retention limits, and appropriate transparency reduce privacy and misuse risks.

34. What is the purpose of continuous authorization when used alongside Continuous Authentication?

  1. To verify identity only during account creation
  2. To automatically approve every request after login
  3. To reassess whether requested actions remain permitted as context and policy change
  4. To replace all application security checks with biometric sensors

Answer: C) To reassess whether requested actions remain permitted as context and policy change

Explanation:

Continuous Authentication focuses on ongoing identity and session trust assessment. Continuous authorization reevaluates whether actions should be allowed under current policies and context, providing complementary protection when permissions or risk change.

35. Which action can help limit damage if Continuous Authentication detects a compromised session?

  1. Allowing the session to retain all privileges indefinitely
  2. Revoking the session and invalidating relevant tokens according to the system's capabilities
  3. Disabling the user's audit trail
  4. Automatically adding the session to an allowlist

Answer: B) Revoking the session and invalidating relevant tokens according to the system's capabilities

Explanation:

Revoking active sessions and related tokens can stop further use of compromised access. Systems should ensure that revocation is enforced across connected applications and services as quickly as practical.

36. How can Continuous Authentication help protect a financial application?

  1. By allowing all transfers without verification
  2. By removing transaction limits and authorization policies
  3. By assuming that every session remains safe after login
  4. By detecting suspicious session activity and requiring additional verification for high-risk transactions

Answer: D) By detecting suspicious session activity and requiring additional verification for high-risk transactions

Explanation:

Financial applications can combine session risk signals with transaction-specific controls. Unusual behavior or high-value transactions may trigger step-up authentication, transaction limits, additional approval, or denial according to policy.

37. Which metric can help evaluate the performance of a Continuous Authentication system?

  1. False-positive and false-negative rates
  2. The number of icons displayed on a login page
  3. The color of the authentication screen
  4. The number of letters in each user's name

Answer: A) False-positive and false-negative rates

Explanation:

False-positive and false-negative rates help show how often a system incorrectly flags legitimate users or misses risky activity. Detection latency, user friction, and the quality of responses are also useful evaluation measures.

38. Why is low detection latency important in Continuous Authentication?

  1. It guarantees that every suspicious event will be detected
  2. It removes the need to secure session tokens
  3. It reduces the time between a relevant risk signal and an appropriate security response
  4. It ensures that all user sessions remain active forever

Answer: C) It reduces the time between a relevant risk signal and an appropriate security response

Explanation:

When a system identifies a potentially compromised session, a rapid response can reduce the opportunity for misuse. However, speed must be balanced with reliable signal evaluation to avoid disruptive reactions to ordinary activity.

39. What is an important consideration when applying Continuous Authentication to remote workers?

  1. All remote workers should automatically be treated as attackers
  2. Changes in network location and device context should be assessed alongside other evidence
  3. Remote access should never use multifactor authentication
  4. Every remote worker should receive permanent administrator privileges

Answer: B) Changes in network location and device context should be assessed alongside other evidence

Explanation:

Remote workers may legitimately switch networks, travel, or use different approved devices. Continuous Authentication should consider these circumstances without assuming that every contextual change indicates compromise.

40. Which approach best supports accessibility in a Continuous Authentication system?

  1. Requiring every user to type at a fixed speed
  2. Blocking all users who use assistive technologies
  3. Using behavioral patterns as the only possible verification method
  4. Providing alternative verification methods and accounting for legitimate variations in behavior

Answer: D) Providing alternative verification methods and accounting for legitimate variations in behavior

Explanation:

Behavior-based systems may perform differently for people who use assistive technologies or have changing physical abilities. Accessible alternatives and carefully calibrated policies help prevent unfair lockouts while preserving security.

41. What is the purpose of a continuous risk evaluation engine?

  1. To process relevant identity, device, and activity signals and estimate changing session risk
  2. To generate a permanent password for every employee
  3. To prevent applications from recording access events
  4. To assign every session the same risk value

Answer: A) To process relevant identity, device, and activity signals and estimate changing session risk

Explanation:

A risk evaluation engine combines configured signals and policy rules, sometimes with statistical or machine-learning models, to assess changing conditions. Its output can inform additional verification, access restrictions, alerts, or session revocation.

42. Which statement about Continuous Authentication and multifactor authentication (MFA) is correct?

  1. Continuous Authentication makes MFA unnecessary in every situation
  2. MFA can only be used before a session begins
  3. Continuous Authentication can complement MFA by evaluating session risk after the initial authentication
  4. MFA prevents every form of session hijacking

Answer: C) Continuous Authentication can complement MFA by evaluating session risk after the initial authentication

Explanation:

MFA strengthens identity verification at authentication points, while Continuous Authentication evaluates changing signals during a session. Using both can improve security, but neither eliminates every attack or replaces secure session management.

43. Why should Continuous Authentication decisions be logged?

  1. To make risk scores publicly accessible
  2. To support security investigations, auditing, and policy evaluation
  3. To ensure that every user receives administrator access
  4. To remove the need for incident response

Answer: B) To support security investigations, auditing, and policy evaluation

Explanation:

Logs can record relevant authentication events, risk assessments, step-up challenges, access restrictions, and session termination decisions. They should be protected from unauthorized access and should avoid unnecessary collection of sensitive data.

44. What is a potential danger of setting a Continuous Authentication risk threshold too low?

  1. All malicious activity becomes impossible to detect
  2. Users no longer need to authenticate
  3. The system automatically stops collecting signals
  4. Legitimate users may be challenged or blocked too frequently

Answer: D) Legitimate users may be challenged or blocked too frequently

Explanation:

An overly sensitive threshold may classify normal variation as suspicious, causing false positives and excessive interruptions. Thresholds should be calibrated using realistic data, resource sensitivity, and the consequences of incorrect decisions.

45. What is the main benefit of combining device trust with behavioral analysis?

  1. It can provide complementary evidence about device security and whether activity matches expected user patterns
  2. It guarantees that the device can never be compromised
  3. It removes the need for access policies
  4. It makes every behavioral anomaly proof of malicious intent

Answer: A) It can provide complementary evidence about device security and whether activity matches expected user patterns

Explanation:

Device posture and behavioral analysis assess different aspects of a session. Combining them can improve risk evaluation, provided the system accounts for unreliable signals and does not treat a trusted device as proof that every action is legitimate.

46. Which approach is most appropriate when a user's normal behavior changes because of a new work schedule?

  1. Immediately disable the account permanently
  2. Grant unrestricted access without further assessment
  3. Reassess the context and update the behavioral baseline through controlled processes where appropriate
  4. Ignore every future anomaly for that user

Answer: C) Reassess the context and update the behavioral baseline through controlled processes where appropriate

Explanation:

Behavior can change for legitimate reasons, such as a shift change or new responsibilities. The system should evaluate the new context and adapt its baseline carefully rather than automatically blocking the user or ignoring all future signals.

47. What is the role of policy enforcement in Continuous Authentication?

  1. To calculate a user's typing speed only
  2. To apply the required action based on evaluated risk and organizational rules
  3. To store biometric data without access restrictions
  4. To ensure that no user session can ever expire

Answer: B) To apply the required action based on evaluated risk and organizational rules

Explanation:

Policy enforcement translates risk assessments into actions such as allowing access, requesting stronger verification, restricting a transaction, or terminating a session. Consistent enforcement helps ensure that risk signals lead to meaningful security outcomes.

48. Which challenge is associated with using machine learning for Continuous Authentication?

  1. Machine learning always produces perfect predictions
  2. Models never change when user behavior changes
  3. Training data has no impact on model performance
  4. Models can produce biased or inaccurate results if data is incomplete, unrepresentative, or poorly maintained

Answer: D) Models can produce biased or inaccurate results if data is incomplete, unrepresentative, or poorly maintained

Explanation:

Machine-learning models depend on the quality and representativeness of their data. Poor data, behavior drift, and unsuitable evaluation methods can increase errors, so models require monitoring, testing, and appropriate human oversight.

49. A user signs in successfully from a managed laptop. During the session, the endpoint security agent reports that required protection has been disabled. What is the most appropriate response from a Continuous Authentication system?

  1. Reassess the device risk and apply the relevant policy, such as restricting access or requiring remediation
  2. Ignore the event because the initial login succeeded
  3. Automatically grant the user more privileges
  4. Disable all monitoring for the session

Answer: A) Reassess the device risk and apply the relevant policy, such as restricting access or requiring remediation

Explanation:

The device's security posture has changed after login, so the original authentication result is not sufficient to establish that the session remains acceptable. The system should evaluate the new signal and enforce an appropriate response based on the sensitivity of the resources and organizational policy.

50. A company uses Continuous Authentication to monitor access to a confidential financial system. A signed-in employee normally accesses reports from a managed laptop during business hours. The system detects an unusual device, atypical interaction behavior, and an attempt to export a large volume of confidential data. What is the best response?

  1. Allow the export because the employee passed the initial login
  2. Grant permanent access to prevent further interruptions
  3. Combine the risk signals, restrict or pause the sensitive operation, and require stronger verification or terminate the session according to policy
  4. Delete the audit logs to protect the employee's privacy

Answer: C) Combine the risk signals, restrict or pause the sensitive operation, and require stronger verification or terminate the session according to policy

Explanation:

Multiple unusual signals combined with a high-impact data export indicate elevated session risk. The system should evaluate the evidence together and apply a proportionate response, such as step-up authentication, blocking the export, or revoking the session. Audit records should be preserved securely for investigation, with appropriate privacy safeguards.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.