You save $69.98
A vendor claims payroll sessions remain protected through both the public edge and the internal application hop. Which evidence BEST validates the claim?
Capture plus a negative impostor test verifies both confidentiality in transit and authentication at the second network boundary.
The public padlock covers only the first hop; readable backend tokens show a continuing exposure.
Traffic counters do not establish channel confidentiality or endpoint identity.
Application success without peer validation can conceal an active man-in-the-middle risk.
Two branches exchange sensitive traffic over public carrier links and cannot trust intermediate network operators. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
IPsec protects IP-layer communications over untrusted paths when negotiated and enforced correctly. Tunnel establishment alone does not guarantee internal endpoint authorization or application security.
Router access passwords do not protect transit traffic from untrusted intermediate operators.
Traffic encryption without peer identity binding permits interception by an impostor tunnel endpoint.
Checksums do not provide secrecy or adversary-resistant authentication of packets.
The organization implemented the response to this scenario: Two branches exchange sensitive traffic over public carrier links and cannot trust intermediate network operators. The approved response was: Establish authenticated IPsec tunnels with modern cryptographic suites and managed key rotation. Which statement MOST accurately identifies a remaining risk or constraint?
IPsec protects IP-layer communications over untrusted paths when negotiated and enforced correctly. Packet inspection confirms confidentiality/integrity for protected subnets and rejects spoofed peers.
Tunnel peer authentication does not authorize every internal endpoint transaction.
Long-lived cryptographic state requires managed rekeying and approved algorithms.
IPsec protects the specified path, not every downstream host or application.
Management implemented a response after this event: Two branches exchange sensitive traffic over public carrier links and cannot trust intermediate network operators. The response was: Establish authenticated IPsec tunnels with modern cryptographic suites and managed key rotation. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Packet inspection confirms confidentiality/integrity for protected subnets and rejects spoofed peers. IPsec protects IP-layer communications over untrusted paths when negotiated and enforced correctly.
Reachability is not evidence of active protected packet confidentiality.
A connection indicator cannot prove authenticated peer identity.
Normal availability does not demonstrate authenticated transport protection.
A network team blocks unapproved inbound IPv4 traffic but ignores IPv6. Internal servers have globally routed IPv6 addresses and accept unsolicited IPv6 sessions. What remediation closes this bypass?
Dual-stack hosts can have reachable IPv6 paths independent of IPv4 filtering. Equivalent security intent must be implemented in both address families and transition mechanisms.
Removing IPv4 does not close the unrestricted IPv6 path; it merely shifts traffic.
IPv4 and IPv6 have separate routing and filtering semantics; private IPv4 says nothing about IPv6 exposure.
An IPv4 translation path is not a substitute for IPv6 ingress/egress enforcement.
A data center has installed IPv6 firewall rules that mirror its IPv4 baseline. Which residual exposure must still be assessed?
Native v6 rules are not a complete defense if hosts can learn unauthorized routes or encapsulate IPv6 through different control points.
Encapsulation can obscure the inner address family from controls configured only for outer IPv4 fields.
The two address families have independent scope and reachability.
DNS resolution does not determine or prove actual network forwarding or packet filtering.
A corporate network declares inbound IPv6 exposure equivalent to its restricted IPv4 posture. What exercise best proves the claim?
A real dual-stack negative-and-positive test checks effective reachability rather than policy object existence.
A pure IPv4 scan does not test globally routed IPv6 interfaces or transition bypasses.
Installed configurations do not prove enforcement on actual routes.
Address assignment is not evidence that unwanted IPv6 connections are denied.
Recursive DNS resolvers accept forged responses for a signed financial-services domain. Users are redirected to an attacker’s address despite the authoritative zone using DNSSEC. Which resolver change most directly addresses the forged answers?
DNSSEC-aware resolvers verify signed DNS data against a trust anchor; unsigned or invalid proofs cannot be accepted as authentic for a properly signed zone. This checks integrity, not query confidentiality.
Encrypting the client-to-resolver hop limits local eavesdropping but does not by itself authenticate compromised authoritative data or a malicious resolver response.
A longer TTL can perpetuate a forged mapping and does not authenticate data origin or integrity.
IP origin or path alone does not establish a valid DNSSEC chain or prevent forged DNS response content.
A recursive resolver validates DNSSEC for properly signed zones. What limitation should network architects disclose before calling the deployment a complete DNS-security solution?
DNSSEC provides authenticated DNS data for signed chains; it does not encrypt queried names and cannot validate unsigned records as if signed.
Signing DNS records adds integrity, not confidentiality to conventional client queries.
DNS answer integrity is not server authentication at the application transport layer; TLS certificate checks remain relevant.
DNSSEC authenticates the zone’s asserted data; it cannot judge the safety of content signed by an authorized compromised operator.
A company claims DNSSEC validation prevents tampered records for its signed banking zone. Which controlled test provides the strongest proof?
Positive legitimate resolution and negative signature-tampering tests show the resolver enforces cryptographic data-origin and integrity checks.
HTTPS tests site authentication, not whether the resolver accepts invalid signed DNS data.
Response speed is unrelated to whether an attacker can inject an invalid signed answer.
Key publication without actual validation cannot establish protection against poisoned signed responses.
Employees on public Wi-Fi perform ordinary DNS lookups in cleartext. The organization validates DNSSEC signatures but observers still see the domain names requested. Which change BEST addresses this distinct privacy threat?
DNSSEC authenticates signed DNS data but does not conceal the query on the client–resolver link. Encrypted DNS transport protects query contents in transit while enterprise resolver policy remains necessary.
Additional signatures strengthen origin authentication, not confidentiality of plain DNS queries over the local network.
TTL controls cache lifetime; it does not encrypt query names visible to local observers.
Latency improvements are unrelated to passive disclosure of the requested names.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
