You save $69.98
The organization implemented the response to this scenario: A facial-recognition pilot plans to collect full-resolution video indefinitely to compute short-lived occupancy counts. The approved response was: Redesign collection to minimize identifiers and define short retention and restricted purpose from the outset. Which statement MOST accurately identifies a remaining risk or constraint?
Embedding privacy requirements early avoids relying entirely on downstream access reviews. Data inventory proves only necessary inputs are retained for the approved period and purpose.
Small groups and auxiliary information can enable reidentification or sensitive inference.
Downstream controls do not remove the exposure from unnecessary original capture.
A limited initial purpose does not authorize unrelated future processing.
Management implemented a response after this event: A facial-recognition pilot plans to collect full-resolution video indefinitely to compute short-lived occupancy counts. The response was: Redesign collection to minimize identifiers and define short retention and restricted purpose from the outset. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Data inventory proves only necessary inputs are retained for the approved period and purpose. Embedding privacy requirements early avoids relying entirely on downstream access reviews.
Strong access controls are not proof of retention minimization.
Functional accuracy is separate from the privacy-minimized collection objective.
Absence of an incident is not proof of a purpose-limited data lifecycle.
A system administrator on the corporate LAN can modify every production service solely because the request originates from an office subnet. Which redesign BEST aligns with zero trust?
NIST SP 800-207 rejects implicit trust based on network position or ownership. Access decisions must be policy-driven at the protected resource rather than assumed from the source subnet.
An SSID rename does not enforce who may administer an individual production resource.
Authentication alone does not authorize all actions or evaluate device/session risk.
Address translation does not establish resource-specific authorization or zero-trust evaluation.
A company replaces LAN-based trust with identity and device-aware resource authorization. Which residual risk requires a response design?
Zero trust reduces implicit network trust; it does not render granted sessions safe indefinitely if conditions change.
Device health can change and credentials can be stolen; admission at one moment is not permanent assurance.
Reintroducing location-only privilege contradicts the protected resource authorization design.
Authentication establishes who the principal is; policy still restricts what it may do.
An enterprise claims production admin APIs now enforce zero-trust access rather than trusting the office network. Which test BEST supports the claim?
Positive and negative requests with controlled identity/device conditions demonstrate explicit resource authorization independent of network position.
Network connectivity or a visible login page does not prove a per-resource authorization decision.
This confirms implicit subnet trust remains and fails the proposed principle.
Policy existence is not evidence that enforcement occurs on actual protected API requests.
A SECRET-cleared analyst reads SECRET intelligence and tries to paste its contents into an UNCLASSIFIED collaboration site. Which mandatory information-flow restriction most directly prevents this disclosure?
Bell–LaPadula is a confidentiality information-flow model. A subject may read at its permitted level or below but must not transfer high-level information downward to a less protected object.
Biba primarily governs integrity of information flowing between trust levels, not the SECRET-to-UNCLASSIFIED confidentiality disclosure described.
Read clearance does not automatically authorize declassification or writing sensitive information to a lower level.
Transaction integrity cannot substitute for classification labels and mandatory confidentiality flow enforcement.
A classified system implements Bell–LaPadula rules and successfully prevents SECRET-to-UNCLASSIFIED writes. What security property does that decision NOT establish by itself?
Bell–LaPadula addresses confidentiality. Integrity models such as Biba and trusted validation controls address whether less trustworthy data can corrupt decisions.
That is the very no-write-down confidentiality property the system enforces.
The simple-security property also limits read access above the subject’s authorized level; this is part of confidentiality enforcement.
Labels and mediation are prerequisites for the stated Bell–LaPadula confidentiality control, not an unrelated unresolved property.
An organization asserts that its mandatory confidentiality rules prevent high-classification data from leaking downward. Which negative test MOST directly checks the Bell–LaPadula requirement?
A failed write-down and permitted same-level operation verify the information-flow rule rather than just confirming a user can log in.
That verifies an integrity rule more directly associated with Biba, not the specified confidentiality write-down rule.
Read-down is compatible with Bell–LaPadula, so its success cannot prove prevention of downward disclosure.
Authentication maintenance does not establish label-based confinement of protected data.
A trusted financial ledger imports transaction amounts from an unauthenticated low-integrity public feed and accepts them as authoritative without validation. Which model-oriented control BEST protects integrity?
Biba prevents lower-integrity inputs from silently contaminating higher-integrity decisions. A trusted validation path can endorse approved data before use while preserving source provenance.
Confidentiality restrictions do not establish correctness or integrity of values supplied by an untrusted feed.
Encryption protects confidentiality of transit but not source trust or the correctness of intentionally supplied bad values.
A low-trust publisher writing authoritative records removes the intended integrity boundary and increases corruption risk.
A ledger blocks direct writes from low-integrity public feeds. The business still requires some external prices for approved calculations. What additional design consideration is essential?
A strict integrity policy alone can stop essential data flow. Controlled validation and endorsement enable business use without treating every low-trust input as authoritative.
Encrypted delivery neither validates the publisher’s authority nor the accuracy of submitted prices.
Integrity controls can fail or be bypassed; auditing still supports accountability and tamper detection.
Secrecy labels cannot prove that financial source data is trustworthy for a high-integrity calculation.
An application claims to maintain a trusted financial ledger even when external public data can be submitted. What test BEST demonstrates its Biba-aligned integrity boundary?
This negative-and-positive test shows both enforced integrity separation and a controlled path for legitimate lower-trust inputs.
That is a confidentiality no-write-down test and does not prove ledger integrity or feed validation.
Transport security cannot substitute for a trusted data-endorsement decision before high-integrity updates.
A backup captures state, including potentially corrupted state, and cannot alone prove transactional integrity.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
