You save $69.98
The organization implemented the response to this scenario: A server room uses a fire suppression system that protects equipment but has no occupancy safety or power shutdown procedures. The approved response was: Design fire detection and suppression with life safety, building code and protected equipment considerations. Which statement MOST accurately identifies a remaining risk or constraint?
People safety takes priority while suitable suppression limits facility damage. A supervised exercise verifies alarm, occupant evacuation, power isolation and suppression sequence.
Human exposure and local building code must be evaluated separately.
Systems need integrated procedures, inspection and drills.
Equipment preservation must remain subordinate to life safety.
Management implemented a response after this event: A server room uses a fire suppression system that protects equipment but has no occupancy safety or power shutdown procedures. The response was: Design fire detection and suppression with life safety, building code and protected equipment considerations. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A supervised exercise verifies alarm, occupant evacuation, power isolation and suppression sequence. People safety takes priority while suitable suppression limits facility damage.
Equipment safety is not a substitute for verified occupant protection.
Alarm activation alone does not establish complete fire response.
Written priorities do not prove executable life-safety controls.
A customer portal is retired, but DNS, OAuth clients and service credentials remain active months afterward. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
End-of-life security includes removing access paths and meeting retention obligations. Some operational logs may need protected retention after user-facing service shutdown.
Accessible credentials and callback endpoints can survive retirement and create orphan attack paths.
Premature destruction may violate preservation and break required dependent workflows.
Renaming a service does not revoke its effective access paths.
The organization implemented the response to this scenario: A customer portal is retired, but DNS, OAuth clients and service credentials remain active months afterward. The approved response was: Execute controlled system retirement with dependency migration, credential revocation and recoverable record preservation. Which statement MOST accurately identifies a remaining risk or constraint?
End-of-life security includes removing access paths and meeting retention obligations. Negative authentication and DNS tests show retired access paths fail while required records restore.
Credentials, archival logs and dependent applications can remain active and require lifecycle treatment.
Legal and operational retention may require controlled preservation after retirement.
Identity credentials and alternate routes can persist independently of DNS.
Management implemented a response after this event: A customer portal is retired, but DNS, OAuth clients and service credentials remain active months afterward. The response was: Execute controlled system retirement with dependency migration, credential revocation and recoverable record preservation. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Negative authentication and DNS tests show retired access paths fail while required records restore. End-of-life security includes removing access paths and meeting retention obligations.
A closed UI does not prove access credentials and backend routes are retired.
Service inaccessibility cannot justify destroying required preserved evidence.
Single-path DNS checks do not prove comprehensive decommissioning.
An architect assumes an HTTPS forward proxy can inspect an encrypted proprietary UDP stream. What should be done before selecting the inspection control?
An HTTP application proxy does not automatically parse arbitrary UDP protocols or decrypt their payloads.
Port numbers do not determine protocol semantics or plaintext visibility.
Global decryption creates unacceptable confidentiality exposure and still may not add UDP parser support.
Packet filtering and application-level validation have different capabilities.
A security team successfully deploys an HTTP proxy on a web subnet. What important blind spot can remain?
Protocol and routing coverage must be established independently of the proxy's deployment status.
Supported HTTP processing is a capability, not the unresolved blind spot.
A certificate establishes channel identity, not parser completeness.
Capacity upgrades do not implement protocol decoding or authorization policy.
What validation BEST demonstrates correct protocol-to-control mapping?
Positive and negative protocol tests establish coverage and safe handling of uninspectable traffic.
A healthy process does not prove coverage of non-HTTP or bypass paths.
Aggregate throughput cannot prove application-level inspection.
Browser traffic alone omits the high-risk proprietary UDP path.
A payroll portal terminates TLS at a public load balancer and forwards session tokens in plaintext across a separately administered, untrusted backend network. Which change BEST secures that trust boundary?
Confidentiality on the browser-to-edge hop ends at TLS termination; another untrusted link requires its own authenticated transport protection.
The padlock protects the browser-edge connection, not subsequent forwarding from the edge to application servers.
More front-end certificates cannot protect plaintext traveling across a separate untrusted internal segment.
Unrestricted backend access and name obscurity do not provide encryption or peer identity assurance.
A payroll team enables TLS between its load balancer and application servers. Which remaining implementation requirement is essential to avoid a false sense of backend security?
Encryption to the wrong endpoint can still disclose sensitive content. Certificate and peer validation give meaning to the established protected channel.
Cipher negotiation does not demonstrate that the intended backend endpoint was authenticated.
Private network location is not proof of peer identity or a trusted certificate chain.
Front-end TLS status does not relieve the requirement to secure the separate untrusted backend hop.
A vendor claims payroll sessions remain protected through both the public edge and the internal application hop. Which evidence BEST validates the claim?
Capture plus a negative impostor test verifies both confidentiality in transit and authentication at the second network boundary.
The public padlock covers only the first hop; readable backend tokens show a continuing exposure.
Traffic counters do not establish channel confidentiality or endpoint identity.
Application success without peer validation can conceal an active man-in-the-middle risk.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
