You save $69.98
Management implemented a response after this event: A storage team proposes RSA encryption of every byte of multi-terabyte backups for performance and key management. The response was: Use suitable symmetric authenticated bulk encryption and protect small data keys with an authorized key-management mechanism. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Large backups encrypt and decrypt efficiently and altered ciphertext is detected. Symmetric cryptography efficiently handles large data; asymmetric operations are suited to limited-size key exchange/signatures.
Performance alone is not authenticated confidentiality and alteration detection.
Encrypted backup bytes do not demonstrate protected key custody.
Compression statistics cannot establish correct cryptographic operation or recoverability.
A service trusts a TLS certificate only because it is self-signed and its common name resembles the server DNS name. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Public-key certificates establish identity only within a trusted chain and verified usage constraints. Trusted roots can still be misissued or compromised and need monitoring and incident response.
A matching-looking name without authorized trust and identity validation permits impostor certificates.
Transport reachability does not prove certificate authorization, timing or status.
An untrusted key source can make an attacker-controlled certificate appear acceptable.
The organization implemented the response to this scenario: A service trusts a TLS certificate only because it is self-signed and its common name resembles the server DNS name. The approved response was: Validate trusted chain, name binding, validity and revocation as appropriate for the connection. Which statement MOST accurately identifies a remaining risk or constraint?
Public-key certificates establish identity only within a trusted chain and verified usage constraints. An unauthorized certificate fails validation while the intended endpoint succeeds.
Trust anchors and issuer controls may be compromised and require incident and revocation mechanisms.
Host binding must match the authenticated identifier, not an approximate string.
A client can complete insecure handshakes when validation is disabled or misconfigured.
Management implemented a response after this event: A service trusts a TLS certificate only because it is self-signed and its common name resembles the server DNS name. The response was: Validate trusted chain, name binding, validity and revocation as appropriate for the connection. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
An unauthorized certificate fails validation while the intended endpoint succeeds. Public-key certificates establish identity only within a trusted chain and verified usage constraints.
Connectivity is not evidence of correctly authenticated peer identity.
Validity period alone does not establish an authorized certification path.
A successful request is not evidence of trust and status validation.
An adversary records years of TLS traffic and later steals the web server’s long-term private key. Which TLS key-establishment design BEST protects the confidentiality of those previously captured sessions?
Ephemeral key exchange prevents an attacker armed only with a later stolen static server key from reconstructing earlier negotiated traffic keys.
A later compromise of the RSA decryption private key can expose past captured key-exchange material for that legacy design.
Retained session key copies eliminate much of the benefit of forward secrecy if the attacker can obtain them.
Removing authentication invites man-in-the-middle attacks and does not establish a trustworthy secure channel.
A TLS 1.3 service uses properly authenticated ephemeral key exchange. Which threat is NOT automatically eliminated by forward secrecy?
Forward secrecy limits retrospective decryption after later long-term-key compromise; it cannot protect plaintext already available to a fully compromised endpoint. Separately, TLS 1.3 0-RTT early data lacks forward secrecy and normal 1-RTT replay guarantees, so it must not be treated as equivalent to completed authenticated ephemeral sessions.
Properly negotiated ephemeral keys are not derivable merely from the later static authentication key.
The security objective remains authenticated confidential communication, not unauthenticated key exchange.
Ephemeral secret agreement is used to derive confidential traffic keys; it does not expose those secrets publicly.
A service claims forward secrecy protects captured historical TLS traffic from later theft of the server certificate key. What test MOST directly examines this claim?
The exercise distinguishes the effect of long-term certificate compromise from compromise of separate ephemeral/session secrets.
Certificate validity alone does not establish ephemeral key agreement or historical confidentiality.
This result shows the legacy insecure design fails, not that the deployed service provides forward secrecy.
Transport reachability is unrelated to whether historical session keys survive compromise of a long-term key.
An organization rotates an encryption key by deleting old decrypt material immediately, breaking retained archive recovery. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Rotation reduces exposure without making legally retained ciphertext unrecoverable. Compromise response may require urgent revocation, but that is a distinct risk decision.
Immediate destruction can strand legally retained ciphertext that depends on the old key.
Unbounded key access creates unnecessary exposure while avoiding controlled rotation.
Key rotation does not retroactively change ciphertext that was encrypted under older material.
The organization implemented the response to this scenario: An organization rotates an encryption key by deleting old decrypt material immediately, breaking retained archive recovery. The approved response was: Plan key versions and archive re-encryption or retained controlled decrypt access before retiring old material. Which statement MOST accurately identifies a remaining risk or constraint?
Rotation reduces exposure without making legally retained ciphertext unrecoverable. Archived ciphertext from each active retention period remains decryptable by authorized recovery roles.
Old ciphertext may remain bound to previous key versions.
Compromise response may require urgent revocation and alternative recovery controls.
Historical ciphertext remains exposed if old decrypt-capable material is stolen.
Management implemented a response after this event: An organization rotates an encryption key by deleting old decrypt material immediately, breaking retained archive recovery. The response was: Plan key versions and archive re-encryption or retained controlled decrypt access before retiring old material. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Archived ciphertext from each active retention period remains decryptable by authorized recovery roles. Rotation reduces exposure without making legally retained ciphertext unrecoverable.
Testing only new ciphertext does not demonstrate historical retention recoverability.
Inventory metadata alone is not proof of usable decrypt authority.
Version creation is not evidence that exposure is controlled and retained records remain readable.
A signing device uses strong algorithms but reveals secret-dependent timing differences across chosen inputs. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Side-channel attacks exploit implementation leakage rather than mathematical cipher breaks. Hardware power and cache leakage may persist despite constant-time source code.
Stronger math does not eliminate information leaked through implementation timing.
Transport protection does not remove computation-time leakage observable at the endpoint.
User messaging cannot mitigate a side channel in secret-dependent execution.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
