You save $69.98
At a distribution center, the branch support lead must add another factor to privileged access rather than relying on knowledge of a password alone. Which choice best addresses the stated requirement?
Multi-factor authentication requires factors from distinct categories rather than two secrets of the same type.
Two passwords remain knowledge factors; MFA requires an independent possession or inherence factor.
A VLAN ID is not identity verification.
Two memorized passwords remain the same knowledge factor.
At a biotech lab, an implementation partner is evaluating certificate-based device management authentication. Which choice best addresses the stated requirement?
Certificate authentication relies on trusted issuance and matching endpoint identity, not a certificate file existing alone.
Unvalidated issuer identity permits impersonation.
MAC addresses can be spoofed and are not certificate trust chains.
A matching identity is one input; trust also requires appropriate issuer-chain, validity period and other policy checks.
At a payment processor, the migration lead needs to authenticate a specific enrolled administrator using something inherent to the person as an additional factor. Which choice best addresses the stated requirement?
Biometrics can provide an inherence factor when supported and properly enrolled.
Hostnames do not verify personal identity.
A PIN is something known, not a biometric.
Hardware identifiers of a router do not authenticate the human.
At a logistics provider, the infrastructure lead must rotate an administrator secret after exposure while preventing old credentials from remaining usable. Which choice best addresses the stated requirement?
Credential recovery requires revocation as well as issuance; otherwise old passwords remain attack paths.
Rotating only one entry point leaves a usable compromised secret elsewhere; revoke and verify credentials across all affected access paths.
That leaves the compromise valid.
Hostname changes do not invalidate exposed credentials.
At a manufacturing plant, a network operations engineer must implement a strong administrator password policy for routers managed by multiple teams. During review, someone proposes: "Reuse the same easy password on every router." Which technical explanation most directly shows why this proposal does not solve the requirement?
Credential reuse amplifies one-device compromise. The effective remedy is to require sufficiently long unique passwords and restrict credential reuse with an approved manager.
Plaintext distribution exposes stored credentials, but the actual alternative to reject is weak password sharing rather than storage alone.
Long unique secrets resist guessing and credential reuse attacks better than short shared values. A true general network fact is not necessarily the direct diagnosis. The named change was reuse the same easy password on every router, whose relevant defect is that credential reuse amplifies one-device compromise.
Short secrets are vulnerable to offline and online guessing. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed reuse the same easy password on every router. The actual issue is that credential reuse amplifies one-device compromise.
At an airport terminal, the infrastructure lead must add another factor to privileged access rather than relying on knowledge of a password alone. During review, someone proposes: "Ask for two passwords as two different factor categories." Which technical explanation most directly shows why this proposal does not solve the requirement?
Two memorized passwords remain the same knowledge factor. The effective remedy is to add an independent MFA factor such as a hardware token or authenticator tied to identity.
Multi-factor authentication requires factors from distinct categories rather than two secrets of the same type. A true general network fact is not necessarily the direct diagnosis. The named change was ask for two passwords as two different factor categories, whose relevant defect is that two memorized passwords remain the same knowledge factor.
A VLAN ID is not identity verification. It concerns a different proposed change, not the change being evaluated.
Hostnames are generally public device labels, not an authentication factor. This observation would apply to another device or feature, not the proposed ask for two passwords as two different factor categories. For this scenario, two memorized passwords remain the same knowledge factor is the direct cause.
At a field-service firm, the migration lead is evaluating certificate-based device management authentication. During review, someone proposes: "Accept any self-signed certificate without verifying trust." Which technical explanation most directly shows why this proposal does not solve the requirement?
Unvalidated issuer identity permits impersonation. The effective remedy is to validate certificate chain, identity and expiry as part of the trust decision.
DNS mapping is not certificate verification. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed accept any self-signed certificate without verifying trust. The actual issue is that unvalidated issuer identity permits impersonation.
Certificate authentication relies on trusted issuance and matching endpoint identity, not a certificate file existing alone. The statement addresses a different mechanism. Here the engineer specifically proposed accept any self-signed certificate without verifying trust; the decisive limitation is that unvalidated issuer identity permits impersonation.
MAC addresses can be spoofed and are not certificate trust chains. It concerns a different proposed change, not the change being evaluated.
At a payment processor, a network administrator needs to authenticate a specific enrolled administrator using something inherent to the person as an additional factor. During review, someone proposes: "Use a second PIN and call it inherence." Which technical explanation most directly shows why this proposal does not solve the requirement?
A PIN is something known, not a biometric. The effective remedy is to use an approved biometric mechanism with secure fallback and privacy controls.
Biometrics can provide an inherence factor when supported and properly enrolled. The statement addresses a different mechanism. Here the engineer specifically proposed use a second pin and call it inherence; the decisive limitation is that a PIN is something known, not a biometric.
Hostnames do not verify personal identity. It concerns a different proposed change, not the change being evaluated.
Hardware identifiers of a router do not authenticate the human. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed use a second pin and call it inherence. The actual issue is that a PIN is something known, not a biometric.
At an insurance company, the infrastructure lead must rotate an administrator secret after exposure while preventing old credentials from remaining usable. During review, someone proposes: "Keep the exposed password enabled alongside the new one indefinitely." Which technical explanation most directly shows why this proposal does not solve the requirement?
That leaves the compromise valid. The effective remedy is to revoke the exposed secret, issue a unique replacement, and validate all affected management paths.
Credential recovery requires revocation as well as issuance; otherwise old passwords remain attack paths. This observation would apply to another device or feature, not the proposed keep the exposed password enabled alongside the new one indefinitely. For this scenario, that leaves the compromise valid is the direct cause.
Hostname changes do not invalidate exposed credentials. It concerns a different proposed change, not the change being evaluated.
DNS changes do not revoke account secrets. The statement addresses a different mechanism. Here the engineer specifically proposed keep the exposed password enabled alongside the new one indefinitely; the decisive limitation is that that leaves the compromise valid.
At a university, the migration lead must protect traffic between two site routers across an untrusted internet service. Which choice best addresses the stated requirement?
IPsec can provide confidentiality/integrity for traffic between two gateway peers over an untrusted path.
A plain proxy does not create IPsec SAs or encrypted tunnels.
802.1Q tags are not cryptographic key material.
CDP is not a routed VPN.
At a supply depot, the campus network lead has remote employees connecting individually to a protected corporate network over the internet. Which choice best addresses the stated requirement?
Remote-access VPNs establish protected sessions from individual devices to an enterprise gateway.
DHCP does not encrypt remote traffic.
Fixed gateway tunnels are not automatically per-user access VPNs.
Open access bypasses remote VPN security.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (760 Questions, Last Updated on Nov 4, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
