Download Is Your Jira Instance Secure Practice Exam and more Exams Technology in PDF only on Docsity!
Question 1. Which authentication protocol allows Jira Cloud users to log in using their organization's identity provider? A) SAML B) LDAP C) RADIUS D) Kerberos Answer: A Explanation: Jira Cloud supports SAML for Single Sign-On (SSO), enabling integration with external identity providers. Question 2. What is the primary benefit of enforcing Multi-Factor Authentication (MFA) for Jira administrators? A) Reduces support tickets B) Enhances defense against account compromise C) Improves user experience D) Increases project performance Answer: B Explanation: MFA adds an extra security layer, making it harder for attackers to compromise high- privilege accounts. Question 3. Which Jira feature should be used to restrict certain project issues to specific users or groups? A) Issue Security Schemes B) Global Permissions C) Field Configurations D) Workflow Validators Answer: A
Explanation: Issue Security Schemes control which users can view particular issues within a project. Question 4. What does the Principle of Least Privilege mean in the context of Jira permissions? A) Granting all permissions to all users B) Users receive only the permissions necessary to perform their tasks C) Assigning maximum permissions by default D) Limiting permissions to system administrators only Answer: B Explanation: The Principle of Least Privilege ensures users get only the access they require, minimizing potential security risks. Question 5. Why should you disable public signup (self-service account creation) in Jira? A) To speed up user onboarding B) To prevent unauthorized access C) To reduce database load D) To enable anonymous issue creation Answer: B Explanation: Disabling public signup helps prevent attackers from creating unauthorized accounts in your Jira instance. Question 6. Which is a recommended way to secure REST API access to Jira Cloud? A) Use Basic Authentication with username and password B) Use OAuth 2.0 tokens C) Allow anonymous API access D) Share API tokens with all team members Answer: B
Answer: A Explanation: Setting complexity requirements ensures users create strong passwords, improving security. Question 10. What is a security benefit of integrating Jira with an Identity Provider (IdP) like Azure AD? A) Enables password reuse B) Centralizes user management and improves authentication security C) Disables SSO D) Removes need for permissions Answer: B Explanation: IdP integration centralizes user authentication and can enforce organization-wide security policies. Question 11. Which type of Jira account is managed outside of Jira itself when SSO is enabled? A) Jira-managed account B) IdP-managed account C) Local-only account D) Guest account Answer: B Explanation: IdP-managed accounts are controlled by the organization’s identity provider, not by Jira directly. Question 12. What does CAPTCHA help prevent in Jira authentication? A) Session timeouts B) Credential stuffing and brute-force attacks C) Project archiving
D) Workflow transitions Answer: B Explanation: CAPTCHA challenges help block automated login attempts typical of brute-force and credential stuffing attacks. Question 13. Why should unused or outdated Jira Marketplace apps be disabled or removed? A) To reduce license costs B) To minimize potential security vulnerabilities C) To increase the number of custom fields D) To allow anonymous usage Answer: B Explanation: Unused or outdated apps may contain unpatched vulnerabilities that attackers could exploit. Question 14. How does IP allowlisting enhance Jira security? A) By restricting Jira access to approved IP addresses B) By enabling public dashboards C) By increasing API rate limits D) By disabling SSL Answer: A Explanation: IP allowlisting limits access to Jira only from specified, trusted IP addresses. Question 15. What is the purpose of WebSudo in Jira Server/Data Center? A) To speed up issue indexing B) To require re-authentication for administrative actions C) To enable guest users
D) To track attachment sizes Answer: B Explanation: Audit logs help administrators identify potential security incidents or policy violations. Question 19. What is a secure way to handle Jira API tokens? A) Share them via email B) Store them in a password manager C) Post them in chat channels D) Write them on sticky notes Answer: B Explanation: Password managers securely store and manage sensitive credentials like API tokens. Question 20. Which Jira feature allows granular control over issue visibility within a project? A) Project Roles B) Issue Security Levels C) Status Categories D) Workflow Conditions Answer: B Explanation: Issue Security Levels restrict which users can view specific issues in a project. Question 21. Why should directory synchronization with LDAP/Active Directory be carefully configured in Jira Server/Data Center? A) To reduce network bandwidth B) To avoid syncing unnecessary users and groups, which could lead to over-privileged accounts C) To speed up Jira search
D) To increase logging Answer: B Explanation: Careful configuration avoids syncing users who should not have access and prevents privilege escalation. Question 22. What is the impact of enabling SSO on password management for Jira Cloud? A) Passwords are managed by the identity provider, not by Jira B) Passwords are disabled C) Users can use any password D) Passwords are removed from all accounts Answer: A Explanation: With SSO, user authentication and password policies are enforced by the IdP. Question 23. How can you reduce the risk of data export abuse in Jira? A) Restrict export permissions to trusted users only B) Enable exports for all users C) Share CSV files publicly D) Use unsecured links Answer: A Explanation: Limiting export capabilities to trusted users helps prevent unauthorized data leaks. Question 24. Which action should be taken immediately after detecting a suspected compromise of a Jira instance? A) Notify all users via email B) Isolate the instance and rotate credentials C) Delete the database
C) To give them admin rights for convenience D) To enable anonymous logins Answer: A Explanation: Principle of least privilege applies—only give integrations what's necessary for their tasks. Question 28. What is the risk of storing Jira backup files unencrypted? A) Increased restore speed B) Potential exposure of all Jira data if backup files are stolen C) Backups are smaller D) Faster upgrades Answer: B Explanation: Unencrypted backups can be easily read if accessed by unauthorized parties. Question 29. How does Jira Service Management allow control over customer request visibility? A) Through customer permissions in project settings B) By disabling projects C) By removing request types D) By archiving issues Answer: A Explanation: Customer permissions control who can create and view requests in Jira Service Management. Question 30. Why should API tokens be revoked when no longer needed? A) To free up database space B) To reduce the risk of unauthorized access
C) To speed up the API D) To enable exports Answer: B Explanation: Revoking unused tokens reduces the risk of them being misused. Question 31. What risk arises from granting the "Browse Users" global permission too broadly? A) Users can view all accounts and potentially collect information for phishing B) Users can create projects C) Users can delete issues D) Users can disable plugins Answer: A Explanation: "Browse Users" allows visibility into all user accounts, which can be exploited by attackers for phishing. Question 32. What is a best practice when evaluating new Marketplace Apps for Jira? A) Install all recommended apps B) Review the app’s security documentation and permissions required C) Install apps with lowest downloads D) Ignore vendor updates Answer: B Explanation: Always review security documentation and required permissions to avoid introducing risks. Question 33. What should be included in a secure Jira backup strategy? A) Encrypted, off-site backups with regular recovery testing B) Backups on local disks only
C) Delete logs regularly D) Store logs in plain text on shared drives Answer: A Explanation: WORM storage prevents tampering with audit records. Question 37. What is the function of a Web Application Firewall (WAF) in Jira’s environment? A) Blocking malicious web traffic before it reaches the application B) Increasing attachment size limits C) Speeding up workflow transitions D) Disabling SSL Answer: A Explanation: A WAF helps protect Jira by detecting and blocking malicious HTTP traffic. Question 38. Which Jira feature allows you to control who can perform bulk changes? A) Bulk Change permission in the permission scheme B) Workflow validators C) Issue security schemes D) Field configuration schemes Answer: A Explanation: The Bulk Change permission limits who can perform mass operations on issues. Question 39. What should you do before connecting Jira to an external user directory? A) Review and restrict permissions for directory users B) Enable public sign-up C) Disable logging
D) Allow anonymous access Answer: A Explanation: Only grant directory users the minimum necessary permissions. Question 40. What is the impact of insecure attachment management in Jira? A) Attachments may become accessible to unauthorized users B) Attachments load faster C) Attachments compress automatically D) Attachments are deleted Answer: A Explanation: Poor attachment security can expose sensitive files to unintended users. Question 41. What is a security concern with sharing filters or dashboards publicly in Jira? A) They may reveal sensitive project or issue data to unauthorized users B) They slow down Jira C) They increase attachment sizes D) They create duplicate issues Answer: A Explanation: Public shares can leak data to anyone with the link. Question 42. Which configuration strengthens Jira’s defense against brute-force login attempts? A) Rate limiting login attempts B) Increasing attachment limits C) Enabling anonymous workflows D) Disabling logging
Answer: A Explanation: Without regular permission reviews, users may retain unnecessary access. Question 46. What is a benefit of integrating Jira logs with a Security Information and Event Management (SIEM) system? A) Centralized detection and alerting for security incidents B) Faster search indexing C) Increased attachment upload speed D) Workflow automation Answer: A Explanation: SIEM integration provides centralized monitoring for suspicious activities. Question 47. How can you secure sensitive custom fields in Jira issues? A) Restrict field visibility via Issue Security Levels B) Share fields with all users C) Make fields required D) Use default field values Answer: A Explanation: Issue Security Levels restrict access to sensitive field data. Question 48. What is a risk of granting Jira project roles to groups with many users? A) Increased chance of unauthorized access B) Slow issue creation C) Reduced dashboard performance D) Increased custom field usage
Answer: A Explanation: Large groups may include users who should not access certain data. Question 49. Why should attachment download permissions be carefully managed? A) To prevent unauthorized users from accessing confidential files B) To increase upload speed C) To allow anonymous uploads D) To enable faster backups Answer: A Explanation: Tight control over attachment downloads limits data leakage. Question 50. What does Atlassian’s Security Advisory process provide for Jira administrators? A) Alerts about new vulnerabilities and recommended actions B) License renewal notices C) Workflow templates D) Project archiving tips Answer: A Explanation: Security advisories keep admins informed about risks and mitigation steps. Question 51. Which Jira permission allows users to create issues in a project? A) Create Issues B) Browse Projects C) System Administrator D) Global Permissions Answer: A
Question 55. Why should you review third-party integrations before connecting them to Jira? A) To assess and minimize potential security risks B) To enable public dashboards C) To increase project speed D) To create more custom fields Answer: A Explanation: Third-party integrations may introduce vulnerabilities or excessive permissions. Question 56. What is the advantage of using project roles over groups in Jira permissions? A) Greater flexibility for project-level access control B) Faster workflow transitions C) Increased attachment limits D) Easier field configuration Answer: A Explanation: Project roles allow context-specific control that is easier to manage per project. Question 57. What is the purpose of a permission scheme in Jira? A) To define who can perform actions in a project B) To speed up search indexing C) To allow anonymous usage D) To increase attachment size Answer: A Explanation: Permission schemes map user roles and groups to project actions.
Question 58. Why should you set a retention policy for audit logs in Jira? A) To ensure logs are available for compliance and investigations B) To reduce server performance C) To enable anonymous auditing D) To speed up upgrades Answer: A Explanation: Retention policies guarantee logs are kept for a required period. Question 59. What is a security best practice for Jira Data Center’s database credentials? A) Store credentials securely and restrict access B) Share credentials with all admins C) Use default database passwords D) Write credentials in documentation Answer: A Explanation: Secure credential storage prevents unauthorized database access. Question 60. How does Jira’s Permission Helper assist administrators? A) Diagnoses why a user cannot access an issue and suggests solutions B) Increases project limits C) Automates workflow transitions D) Disables logging Answer: A Explanation: Permission Helper analyzes permission settings to troubleshoot access problems. Question 61. Which of the following can help prevent data loss after a ransomware attack on Jira?
