AP Cybersecurity Drill 18: Shared-Workstation Security Policy

Question 1. What is the main weakness of the current shared-login account model?

• A) It forces each person to memorize a separate long password just to sign in each time
• B) It automatically locks the workstation the moment it sits idle for a while
• C) It requires a phone code in addition to a password at every single sign-in attempt
• D) It makes actions untraceable to a person, since everyone uses the same login ✓

Explanation: Choice D is correct. With one shared login, the logs cannot tell who did what, so individual accountability is lost. Choice A is incorrect. A single shared login means fewer passwords, not separate ones per person. Choice B is incorrect. The current setting never locks on idle, which is part of the problem, not the model's effect. Choice C is incorrect. Multi-factor is currently off, so no phone code is required.

Question 2. Which proposed change most directly limits someone walking up to an unattended, signed-in workstation?

• A) Switching from a shared login to one individual account per staff member
• B) Locking the screen automatically after five minutes of no activity ✓
• C) Locking the account after five failed password attempts in a row
• D) Turning on a second factor that is required during each login

Explanation: Choice B is correct. An idle screen lock blanks and secures the session after inactivity, which is the specific risk of an unattended, already-signed-in machine. Choice A is incorrect. Individual accounts add accountability but do not lock an already open session. Choice C is incorrect. Lockout addresses repeated guessing, not a walk-up to an open session. Choice D is incorrect. Multi-factor protects the login step, not a session already open.

Question 3. Which proposed setting would most help the team detect repeated password-guessing against an account?

• A) Turning on multi-factor so that a code is needed in addition to the account password
• B) Locking the screen after five idle minutes on the shared workstation
• C) Locking the account after five failed attempts, a visible lockout event ✓
• D) Giving each staff member an individual login instead of a shared one

Explanation: Choice C is correct. A lockout after several failures both stops the run of bad guesses and records a visible lockout event, giving staff a clear signal that guessing is happening. Choice A is incorrect. Multi-factor blocks misuse but does not by itself highlight a guessing pattern. Choice B is incorrect. An idle lock addresses unattended sessions, not guessing. Choice D is incorrect. Individual logins aid attribution but do not detect repeated failures on their own.

Question 4. Why does adding multi-factor authentication reduce risk even if a staff password is stolen?

• A) A stolen password alone is not enough, since a second factor is still required ✓
• B) The password is automatically changed every time someone signs in to the system
• C) The workstation stops needing any password once multi-factor is switched on
• D) Every failed login is silently ignored so attackers receive no feedback at all

Explanation: Choice A is correct. Multi-factor means access requires both the password and a separate factor, so a thief holding only the password still cannot get in. Choice B is incorrect. Multi-factor does not rotate the password on each login. Choice C is incorrect. Multi-factor adds a factor; it does not remove the password. Choice D is incorrect. Ignoring failed logins is not how multi-factor works and would hide attacks.

Question 5. Taken together, which single change best preserves a per-person record of who performed each action?

• A) Enabling the five-minute idle screen lock on the shared front-desk workstation
• B) Enabling account lockout after five consecutive failed attempts
• C) Enabling multi-factor authentication for each staff sign-in step at the desk
• D) Replacing the shared login with an individual account per staff member ✓

Explanation: Choice D is correct. Individual accounts tie each logged action to a specific person, restoring the accountability the shared login destroyed. Choice A is incorrect. An idle lock secures sessions but does not attribute actions. Choice B is incorrect. Lockout slows guessing but does not identify who acted. Choice C is incorrect. Multi-factor strengthens login but, on a shared account, still leaves actions unattributed.