You save $69.98
The team extends key retention through the legal archive period. What risk STILL must be addressed?
Key-lifecycle compliance requires independent recoverability and backup custody tests.
Rotated data keys and versions can be necessary to decrypt old records.
Retention calls for controlled recoverability, not unrestricted access.
Key rotation does not end the underlying legal records obligation.
Which result BEST demonstrates compliant long-term encrypted archive retention?
End-to-end recovery proves both durable records and usable authorized decryption over time.
Object presence does not establish the availability of correct decryption keys.
Current-key existence does not prove access to keys protecting historical ciphertext.
A fresh file does not validate the oldest retained key versions or formats.
A life-critical system uses an unsupported network appliance that cannot receive security patches. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
EOL/EOS status raises vulnerability and maintenance risks, not automatically a mandate for unplanned shutdown. Compensating isolation must be monitored and cannot substitute indefinitely for supported operation.
Unplanned removal of an essential system can create unacceptable safety and availability impact.
Unsupported software may have no patch path; temporary exposure controls and replacement are needed.
One compensating product cannot eliminate all lifecycle and unpatched vulnerabilities.
The organization implemented the response to this scenario: A life-critical system uses an unsupported network appliance that cannot receive security patches. The approved response was: Assess business and security impact, isolate exposure and fund a controlled supported replacement plan. Which statement MOST accurately identifies a remaining risk or constraint?
EOL/EOS status raises vulnerability and maintenance risks, not automatically a mandate for unplanned shutdown. A time-bound risk plan and verified segmentation protect the device until replacement.
Compensating isolation is time-bounded risk reduction, not a permanent supported lifecycle solution.
Business and safety impact require controlled risk-based transition rather than automatic shutdown.
Future defects and unavailable vendor fixes remain significant exposure.
Management implemented a response after this event: A life-critical system uses an unsupported network appliance that cannot receive security patches. The response was: Assess business and security impact, isolate exposure and fund a controlled supported replacement plan. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A time-bound risk plan and verified segmentation protect the device until replacement. EOL/EOS status raises vulnerability and maintenance risks, not automatically a mandate for unplanned shutdown.
Paper compensations cannot prove a temporary mitigation operates.
Control removal that breaks essential operation is not a successful risk treatment.
The expiration notice does not evidence a bounded remediation plan.
A team wants to wipe a database server that still feeds a weekly regulatory reconciliation process. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Decommissioning requires proving that the asset and its data are no longer required. A successful nightly backup does not establish every external consumer has migrated.
A backup cannot demonstrate that reconciliation dependencies have migrated.
Premature shutdown can interrupt legally required dependent processes.
Lifecycle decommission requires dependency and preservation authorization before destruction.
The organization implemented the response to this scenario: A team wants to wipe a database server that still feeds a weekly regulatory reconciliation process. The approved response was: Verify downstream dependencies, legal retention, final export and business signoff before sanitization. Which statement MOST accurately identifies a remaining risk or constraint?
Decommissioning requires proving that the asset and its data are no longer required. Retirement evidence includes dependency checks, reconciliation and approved destruction logs.
Backups establish recoverability of data, not completion of migration for downstream consumers.
Owners and legal authorities may have duties outside infrastructure control.
Required records and scheduled reporting may survive service retirement.
Management implemented a response after this event: A team wants to wipe a database server that still feeds a weekly regulatory reconciliation process. The response was: Verify downstream dependencies, legal retention, final export and business signoff before sanitization. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Retirement evidence includes dependency checks, reconciliation and approved destruction logs. Decommissioning requires proving that the asset and its data are no longer required.
Backups did not validate the critical downstream dependency.
Technical shutdown is not full authorized data and service retirement.
Ticket closure cannot confirm that business consumers no longer need the original system.
Employees can upload confidential source files to personal webmail despite endpoint disk encryption. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Encryption at rest does not stop an authorized user from disclosing data to an external service. DLP classification false positives need tuning and accountable exception handling.
At-rest encryption does not govern authorized decryption followed by exfiltration.
Labels alone cannot prevent copying data to unauthorized destinations.
A narrow network rule leaves the actual endpoint egress route available.
The organization implemented the response to this scenario: Employees can upload confidential source files to personal webmail despite endpoint disk encryption. The approved response was: Enforce context-aware DLP controls at relevant egress channels with approved business exceptions. Which statement MOST accurately identifies a remaining risk or constraint?
Encryption at rest does not stop an authorized user from disclosing data to an external service. An unapproved upload is blocked while documented legitimate transfers remain possible.
Sensitive-content classification requires tuning and accountable handling of authorized transfers.
Endpoints decrypt authorized content for users, so separate exfiltration controls remain necessary.
Content transformation and alternative channels require contextual and layered controls.
Management implemented a response after this event: Employees can upload confidential source files to personal webmail despite endpoint disk encryption. The response was: Enforce context-aware DLP controls at relevant egress channels with approved business exceptions. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
An unapproved upload is blocked while documented legitimate transfers remain possible. Encryption at rest does not stop an authorized user from disclosing data to an external service.
At-rest encryption does not prove outbound sensitive-data restriction.
Misconfigured enforcement fails both data protection and sanctioned workflow requirements.
Awareness metrics cannot demonstrate effective egress denial.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
