You save $69.98
The organization implemented the response to this scenario: Operations receives sampled firewall counters but cannot correlate which lateral path carried a suspected data leak. The approved response was: Collect scoped network-flow metadata with synchronized timestamps, secure retention and identity context. Which statement MOST accurately identifies a remaining risk or constraint?
Flow telemetry can establish communication patterns even without storing packet contents. A test exfiltration flow is attributable to source, destination, time and applied policy decision.
Metadata can still expose sensitive activity and needs access and retention governance.
Total counters do not preserve the flow-level endpoints or timeline.
Time alignment supports correlation, not authentication of every claimed actor.
Management implemented a response after this event: Operations receives sampled firewall counters but cannot correlate which lateral path carried a suspected data leak. The response was: Collect scoped network-flow metadata with synchronized timestamps, secure retention and identity context. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A test exfiltration flow is attributable to source, destination, time and applied policy decision. Flow telemetry can establish communication patterns even without storing packet contents.
Volume alone is not incident-ready flow attribution.
Unsynchronized telemetry cannot reliably reconstruct the causal path.
Uncontrolled sensitive metadata cannot demonstrate governed investigative observability.
Any unmanaged laptop plugged into an unused office network port receives production VLAN access. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Physical cabling access is not authorization to enter the corporate data network. Quarantine segments must not accidentally bridge into management networks.
Physical proximity is not identity and device-based network admission.
Post-admission inspection does not prevent immediate access from an unmanaged endpoint.
A captive portal alone cannot govern layer 2 production connectivity.
The organization implemented the response to this scenario: Any unmanaged laptop plugged into an unused office network port receives production VLAN access. The approved response was: Require port-based network access control with device/user authentication and safe fallback segments. Which statement MOST accurately identifies a remaining risk or constraint?
Physical cabling access is not authorization to enter the corporate data network. An unknown laptop is placed into a restricted segment while enrolled endpoints reach approved services.
Fallback segmentation needs explicit deny rules and reachability tests.
Local building access is not equivalent to device and user network permission.
Port authentication does not make an endpoint trustworthy for every protected application.
Management implemented a response after this event: Any unmanaged laptop plugged into an unused office network port receives production VLAN access. The response was: Require port-based network access control with device/user authentication and safe fallback segments. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
An unknown laptop is placed into a restricted segment while enrolled endpoints reach approved services. Physical cabling access is not authorization to enter the corporate data network.
Physical connectivity without a controlled enrollment path is not secure network admission.
Configured quarantine is insufficient when forwarding policy reconnects protected networks.
Positive access does not establish the negative admission boundary.
A laptop has current patches but malicious macros are spawning unusual processes and connecting outbound. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Patch compliance reduces known vulnerabilities but does not establish that endpoint behavior is benign. EDR alerts need false-positive handling and tested containment authority.
Patching known flaws does not prevent malicious behavior using legitimate execution tools.
Behavioral attacks may use new or legitimate tools not covered by filename signatures.
Backup readiness cannot detect and contain live malicious endpoint execution.
The organization implemented the response to this scenario: A laptop has current patches but malicious macros are spawning unusual processes and connecting outbound. The approved response was: Deploy and tune endpoint behavior detection with containment and escalation response. Which statement MOST accurately identifies a remaining risk or constraint?
Patch compliance reduces known vulnerabilities but does not establish that endpoint behavior is benign. A simulated suspicious process generates a correlated alert and controlled host containment.
Detections can be false positives and require controlled response authority.
Known-vulnerability maintenance does not eliminate social engineering and payload abuse.
Some behavior-based threats can evade static malware signatures.
Management implemented a response after this event: A laptop has current patches but malicious macros are spawning unusual processes and connecting outbound. The response was: Deploy and tune endpoint behavior detection with containment and escalation response. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A simulated suspicious process generates a correlated alert and controlled host containment. Patch compliance reduces known vulnerabilities but does not establish that endpoint behavior is benign.
OS patch status is not proof of EDR behavioral coverage.
Agent presence cannot establish useful detection and response.
An alert alone is insufficient to demonstrate a responsive containment workflow.
The core network has two routers but both draw power from the same failing distribution unit. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Duplicate devices do not provide redundancy when they share a critical dependency. Redundant routing protocols must also be tested for convergence under an isolated fault.
More devices sharing one critical dependency remain subject to common-mode failure.
Protocol improvement cannot preserve operation when all routers lose power together.
Preference changes do not remove correlated failure of the physical dependency.
The organization implemented the response to this scenario: The core network has two routers but both draw power from the same failing distribution unit. The approved response was: Remove shared power and control-plane single points of failure before claiming resilient routing. Which statement MOST accurately identifies a remaining risk or constraint?
Duplicate devices do not provide redundancy when they share a critical dependency. A power-feed loss leaves one routing path operational without unauthorized bypass.
A single common power failure can disable both at once.
Redundancy requires functional failover and stable route recovery.
Control protocols cannot function when the shared power feed fails.
Management implemented a response after this event: The core network has two routers but both draw power from the same failing distribution unit. The response was: Remove shared power and control-plane single points of failure before claiming resilient routing. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A power-feed loss leaves one routing path operational without unauthorized bypass. Duplicate devices do not provide redundancy when they share a critical dependency.
Device count is not common-mode failure resistance.
Naming diversity cannot establish electrical independence.
A steady routing table does not demonstrate failover readiness.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
