You save $69.98
The organization implemented the response to this scenario: Two customers share a provider edge but route tables inadvertently leak one customer's private prefixes into another tenant. The approved response was: Separate routing contexts using approved virtual routing/forwarding and verify route import/export policies. Which statement MOST accurately identifies a remaining risk or constraint?
VRF isolation prevents unintended route exchange between logically separate tenants. A tenant A prefix is unreachable from tenant B and permitted shared services remain routed.
Misconfigured control-plane policies can leak prefixes despite VRF names.
Private address assignment does not itself create routing separation.
External perimeter rules do not verify cross-tenant route distribution.
Management implemented a response after this event: Two customers share a provider edge but route tables inadvertently leak one customer's private prefixes into another tenant. The response was: Separate routing contexts using approved virtual routing/forwarding and verify route import/export policies. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A tenant A prefix is unreachable from tenant B and permitted shared services remain routed. VRF isolation prevents unintended route exchange between logically separate tenants.
Separate labels cannot establish effective route isolation.
Architectural intention is not tested forwarding and import policy.
Public exposure checks do not prove internal tenant route separation.
A centrally programmed network controller uses a single permanent administrator token for every automation client. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
A controller compromise can reprogram broad forwarding paths across the network. Controller high availability does not solve authorization or integrity of malicious policy changes.
A compromise of any client can reprogram broad forwarding rules across tenants.
Obscurity cannot substitute for client authorization and auditable policy changes.
High availability does not mitigate malicious or overprivileged control-plane commands.
The organization implemented the response to this scenario: A centrally programmed network controller uses a single permanent administrator token for every automation client. The approved response was: Protect the SDN control plane with strong identities, scoped API authorization and auditable change control. Which statement MOST accurately identifies a remaining risk or constraint?
A controller compromise can reprogram broad forwarding paths across the network. A stolen low-privilege automation token cannot alter unrelated tenant forwarding rules.
Replicated management can spread the same unauthorized rule consistently.
Shared identities obscure the actor and defeat least-privilege attribution.
Resource obscurity cannot enforce differentiated API permissions.
Management implemented a response after this event: A centrally programmed network controller uses a single permanent administrator token for every automation client. The response was: Protect the SDN control plane with strong identities, scoped API authorization and auditable change control. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A stolen low-privilege automation token cannot alter unrelated tenant forwarding rules. A controller compromise can reprogram broad forwarding paths across the network.
Working automation does not prove scoped control-plane authority.
Availability metrics are not authorization and accountability evidence.
Presentation authentication does not demonstrate protected automation interfaces.
Network engineers manage core routers through the same production network that disappears during an outage. Which architecture best preserves secure recovery?
Separating management transport from the failed data plane preserves authorized troubleshooting.
Logical VLAN separation does not remove the shared physical connectivity failure.
Broader privilege neither creates an independent path nor preserves accountability.
Configuration backup is useful but not a viable control channel during the outage.
An out-of-band management modem survives a data-plane outage. What additional risk is MOST important?
Independent availability must be paired with restricted users, protocols and monitoring.
Removing auditability undermines accountability on a high-privilege channel.
Transport independence does not establish user authentication or least privilege.
Even redundant power cannot prevent software, routing or operator faults.
Which exercise best demonstrates resilient out-of-band recovery?
This fault test proves independence, availability and protected administrative control together.
Labeling cannot demonstrate actual network independence or secure authentication.
Normal forwarding does not test the emergency management path.
Hardware inventory alone does not prove reachability under failure.
A network service uses anycast to reach a nearby node, but session data is only stored on the previous node. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Routing multiple sites under one destination IP does not replicate application session state. Anycast failover can redirect traffic mid-session and needs application-aware reconnection behavior.
Anycast changes routing destinations; it does not replicate in-memory application state.
Traffic relocation after failure can lose committed business state.
Routing convergence alone cannot repair a missing session or transaction record.
The organization implemented the response to this scenario: A network service uses anycast to reach a nearby node, but session data is only stored on the previous node. The approved response was: Design state continuity and session recovery independently from anycast routing. Which statement MOST accurately identifies a remaining risk or constraint?
Routing multiple sites under one destination IP does not replicate application session state. A failed site redirects new traffic and retained business state remains consistent.
Routing redirection may interrupt connections and requires application recovery design.
Anycast changes the responding location as routes converge.
Network reachability is separate from state replication and business integrity.
Management implemented a response after this event: A network service uses anycast to reach a nearby node, but session data is only stored on the previous node. The response was: Design state continuity and session recovery independently from anycast routing. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A failed site redirects new traffic and retained business state remains consistent. Routing multiple sites under one destination IP does not replicate application session state.
Reachability without state continuity does not meet the business recovery objective.
A routing metric is not evidence of acceptable application failover.
Layer 3 response does not demonstrate durable session or business data.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
