You save $69.98
A signing device uses strong algorithms but reveals secret-dependent timing differences across chosen inputs. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Side-channel attacks exploit implementation leakage rather than mathematical cipher breaks. Hardware power and cache leakage may persist despite constant-time source code.
Stronger math does not eliminate information leaked through implementation timing.
Transport protection does not remove computation-time leakage observable at the endpoint.
User messaging cannot mitigate a side channel in secret-dependent execution.
The organization implemented the response to this scenario: A signing device uses strong algorithms but reveals secret-dependent timing differences across chosen inputs. The approved response was: Apply constant-time operations and side-channel-resistant implementation review and testing. Which statement MOST accurately identifies a remaining risk or constraint?
Side-channel attacks exploit implementation leakage rather than mathematical cipher breaks. Statistical timing tests show no exploitable secret-dependent correlation for supported operations.
Physical and microarchitectural behavior can expose information beyond source-level timing.
Algorithm strength does not certify side-channel resistance of deployed code and hardware.
Payload secrecy does not hide observable timing correlation.
Management implemented a response after this event: A signing device uses strong algorithms but reveals secret-dependent timing differences across chosen inputs. The response was: Apply constant-time operations and side-channel-resistant implementation review and testing. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Statistical timing tests show no exploitable secret-dependent correlation for supported operations. Side-channel attacks exploit implementation leakage rather than mathematical cipher breaks.
Algorithm selection alone does not demonstrate side-channel resistance.
Correct signatures cannot establish resistance to implementation leakage.
Missing measurement data does not demonstrate absence of exploitable side channels.
A decryption API returns detailed padding-error differences for attacker-crafted ciphertexts. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Chosen-ciphertext attacks can turn decryption error behavior into information leakage. Even uniform errors may be insufficient if response timing exposes the failure branch.
Distinct decryption errors can form a practical chosen-ciphertext oracle.
A timing side channel can disclose the same padding-validation information.
Stronger keys do not fix adaptive decryption error leakage.
The organization implemented the response to this scenario: A decryption API returns detailed padding-error differences for attacker-crafted ciphertexts. The approved response was: Use authenticated encryption and uniform error handling to prevent a practical decryption oracle. Which statement MOST accurately identifies a remaining risk or constraint?
Chosen-ciphertext attacks can turn decryption error behavior into information leakage. Modified ciphertext fails authentication without revealing distinguishable decryption details.
Observed timing may still distinguish the failure and enable an oracle.
Lack of authenticated encryption can permit adaptive manipulation or information leakage.
Chosen-ciphertext attacks exploit behavior of a key-holding oracle, not key extraction.
Management implemented a response after this event: A decryption API returns detailed padding-error differences for attacker-crafted ciphertexts. The response was: Use authenticated encryption and uniform error handling to prevent a practical decryption oracle. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Modified ciphertext fails authentication without revealing distinguishable decryption details. Chosen-ciphertext attacks can turn decryption error behavior into information leakage.
Distinguishable failures are exactly the leakage that adaptive oracle attacks exploit.
Equal messages alone do not demonstrate indistinguishable failure behavior.
Positive functionality cannot prove resistance to adaptive chosen-ciphertext queries.
A primary data room is built beneath plumbing in a flood-prone basement despite nearby higher-floor space. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Physical siting choices can create correlated disasters that cannot be patched in software. Higher floors also require evaluating fire, structural, access and utility dependencies.
Credential controls cannot prevent correlated physical flood damage to systems.
Co-located redundancy shares the same environmental hazard.
Financial coverage does not preserve essential service during physical infrastructure loss.
The organization implemented the response to this scenario: A primary data room is built beneath plumbing in a flood-prone basement despite nearby higher-floor space. The approved response was: Select facility location using environmental hazards and critical-system availability requirements. Which statement MOST accurately identifies a remaining risk or constraint?
Physical siting choices can create correlated disasters that cannot be patched in software. Site survey and flooding scenario demonstrate safe equipment placement and evacuation access.
Flood risk may decrease, but fire, structure, power and access still require assessment.
Shared physical exposure can destroy both supposedly redundant devices.
Access protection does not mitigate water intrusion or environmental placement risk.
Management implemented a response after this event: A primary data room is built beneath plumbing in a flood-prone basement despite nearby higher-floor space. The response was: Select facility location using environmental hazards and critical-system availability requirements. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Site survey and flooding scenario demonstrate safe equipment placement and evacuation access. Physical siting choices can create correlated disasters that cannot be patched in software.
Door security is not evidence of safe environmental siting.
Equipment counts do not demonstrate hazard independence.
Financial transfer does not establish safe placement and continuity.
A server room uses a fire suppression system that protects equipment but has no occupancy safety or power shutdown procedures. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
People safety takes priority while suitable suppression limits facility damage. Suppressant compatibility with energized equipment and room integrity must be validated.
Protecting hardware cannot override occupant life safety during discharge.
Detection alone does not control hazardous conditions or approved response sequence.
Physical security cannot prevent lawful safe evacuation of personnel.
The organization implemented the response to this scenario: A server room uses a fire suppression system that protects equipment but has no occupancy safety or power shutdown procedures. The approved response was: Design fire detection and suppression with life safety, building code and protected equipment considerations. Which statement MOST accurately identifies a remaining risk or constraint?
People safety takes priority while suitable suppression limits facility damage. A supervised exercise verifies alarm, occupant evacuation, power isolation and suppression sequence.
Human exposure and local building code must be evaluated separately.
Systems need integrated procedures, inspection and drills.
Equipment preservation must remain subordinate to life safety.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
