You save $69.98
Employees on public Wi-Fi perform ordinary DNS lookups in cleartext. The organization validates DNSSEC signatures but observers still see the domain names requested. Which change BEST addresses this distinct privacy threat?
DNSSEC authenticates signed DNS data but does not conceal the query on the client–resolver link. Encrypted DNS transport protects query contents in transit while enterprise resolver policy remains necessary.
Additional signatures strengthen origin authentication, not confidentiality of plain DNS queries over the local network.
TTL controls cache lifetime; it does not encrypt query names visible to local observers.
Latency improvements are unrelated to passive disclosure of the requested names.
A company enables DNS over HTTPS to its approved enterprise resolver. What operational residual risk should be assessed before declaring the DNS control complete?
Encryption can prevent hotspot eavesdropping while also permitting unauthorized resolver selection. Device and network policy must preserve sanctioned filtering and telemetry.
Protecting a DNS transport does not authenticate every later application endpoint; HTTPS server identity remains separate.
When properly negotiated, DoH encrypts the DNS transport itself; plaintext exposure must be tested at fallback or bypass paths instead.
DNSSEC zone signing is performed by domain operators, and client browsers do not need domain signing keys for encrypted recursive queries.
The security team claims remote clients now have private DNS lookups and still use approved enterprise resolver policies. Which acceptance test is MOST persuasive?
The test checks both confidentiality of the client–resolver channel and that encrypted DNS has not bypassed organizational policy.
Signature validation proves authenticity of signed DNS records, not confidentiality on the hotspot.
Uncontrolled alternate resolvers can evade the stipulated enterprise policy requirement.
Availability and speed do not prove queries were encrypted or required DNS policy was retained.
A compromised internal virtual desktop can connect directly to databases across every business unit because firewalls filter only inbound internet traffic. Which design BEST limits this lateral movement?
North–south perimeter controls do not prevent an internal foothold from traversing unrelated trust boundaries. Resource-scoped policy restricts lateral attack paths.
More perimeter capacity does not restrict traffic among internal workloads behind that perimeter.
Name changes do not prevent a compromised workstation from finding and reaching allowed network services.
Encryption protects transmitted data but cannot alone restrict an unauthorized internal client from initiating a protected session.
An enterprise deploys service-identity-based microsegmentation between internal applications. What residual condition requires ongoing governance?
Static assumptions about service names or certificates can create stale privileges; segmentation must follow current authorized communication patterns.
Subnet colocation does not prove identity or authorize new service interactions.
Dynamic systems need reviewed policy updates and measurement of effective connectivity.
TLS confidentiality is orthogonal to whether a principal is entitled to use a specific service API.
Security asserts east–west segmentation prevents a compromised workstation from reaching unrelated business databases. Which test BEST checks the control?
This probes real unwanted lateral routes and a positive permitted application path rather than relying only on installed firewall policy counts.
Authentication to the LAN alone is the very implicit trust the segmentation intends to remove.
External attack-surface reduction does not demonstrate internal lateral-movement boundaries.
Declared configuration is not evidence that enforcement points apply the policy on actual paths.
Payment containers move among hosts every hour. Subnet IP rules permit unintended services because addresses are reused. Which design BEST maintains microsegmentation?
Identity-based controls follow service intent instead of brittle host-address associations.
Cluster membership alone is not a safe resource authorization boundary.
Stale identifiers can grant another workload unintended payment API access.
Obscurity does not provide enforceable service authorization.
Workload identity now drives east-west access policies. What residual risk still matters?
Microsegmentation limits reachability but cannot ensure an approved caller is not malicious.
Valid connectivity can still carry dangerous inputs; application controls are needed.
Service identity and role scoping do not require administrative escalation.
Authorization and transport encryption are distinct properties.
Which test BEST proves microsegmentation still applies when workloads relocate?
This directly tests identity binding and prevents address-reuse privilege leakage.
Node counts do not show permission decisions after placement changes.
Availability tests do not reveal unintended peer access.
Declarative labels are not proof of runtime enforcement or policy matching.
Two customers share a provider edge but route tables inadvertently leak one customer's private prefixes into another tenant. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
VRF isolation prevents unintended route exchange between logically separate tenants. Control-plane misconfiguration can still leak routes despite separate named contexts.
Common route propagation can leak tenant connectivity before downstream application policy.
Naming isolated contexts is ineffective when import/export policies reconnect them.
Address translation does not establish independent routing and tenant isolation.
The organization implemented the response to this scenario: Two customers share a provider edge but route tables inadvertently leak one customer's private prefixes into another tenant. The approved response was: Separate routing contexts using approved virtual routing/forwarding and verify route import/export policies. Which statement MOST accurately identifies a remaining risk or constraint?
VRF isolation prevents unintended route exchange between logically separate tenants. A tenant A prefix is unreachable from tenant B and permitted shared services remain routed.
Misconfigured control-plane policies can leak prefixes despite VRF names.
Private address assignment does not itself create routing separation.
External perimeter rules do not verify cross-tenant route distribution.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
