You save $69.98
An internal voice system encrypts audio but unauthenticated signaling lets attackers redirect calls and impersonate extensions. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Media encryption cannot prevent signaling-level hijacking or fraudulent call setup. Emergency calling and availability requirements must be tested after strengthening controls.
Protected audio does not stop signaling spoofing, rerouting or impersonation.
Improved sound quality cannot address signaling-level identity fraud.
Presentation changes do not enforce trusted signaling integrity.
The organization implemented the response to this scenario: An internal voice system encrypts audio but unauthenticated signaling lets attackers redirect calls and impersonate extensions. The approved response was: Protect call signaling integrity and identity in addition to media confidentiality. Which statement MOST accurately identifies a remaining risk or constraint?
Media encryption cannot prevent signaling-level hijacking or fraudulent call setup. Spoofed call-setup requests fail while legitimate encrypted calls complete.
Media confidentiality does not authenticate signaling or call initiation.
Stronger authorization may change call routing and requires operational testing.
Control-plane messages are distinct from the media channel and need protection.
Management implemented a response after this event: An internal voice system encrypts audio but unauthenticated signaling lets attackers redirect calls and impersonate extensions. The response was: Protect call signaling integrity and identity in addition to media confidentiality. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Spoofed call-setup requests fail while legitimate encrypted calls complete. Media encryption cannot prevent signaling-level hijacking or fraudulent call setup.
Media secrecy is not signaling authenticity.
Voice quality does not demonstrate identity or session-control integrity.
Completion counts do not prove that call establishment was authenticated.
An employee's smart badge is deactivated in HR but copied badge numbers still open a secure server-room reader. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Simple badge identifiers can be cloned, and revocation must reach all enforcement readers. Offline readers may keep stale access lists, requiring bounded synchronization and monitoring.
Identity deactivation must be enforced by readers and cannot repair insecure cloneable badge formats.
Warning labels do not stop use of copied badge numbers.
Recording an access violation is not equivalent to denying a stale or cloned credential.
The organization implemented the response to this scenario: An employee's smart badge is deactivated in HR but copied badge numbers still open a secure server-room reader. The approved response was: Use cryptographically authenticated access credentials and tie physical lifecycle to authoritative identity revocation. Which statement MOST accurately identifies a remaining risk or constraint?
Simple badge identifiers can be cloned, and revocation must reach all enforcement readers. A cloned identifier is denied and the revoked credential fails at every critical entry point.
Readers may maintain stale permissions and require bounded updates or local control.
Simple static IDs can be copied regardless of card branding.
Badge presentation alone may not authenticate the human when credentials are cloneable.
Management implemented a response after this event: An employee's smart badge is deactivated in HR but copied badge numbers still open a secure server-room reader. The response was: Use cryptographically authenticated access credentials and tie physical lifecycle to authoritative identity revocation. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A cloned identifier is denied and the revoked credential fails at every critical entry point. Simple badge identifiers can be cloned, and revocation must reach all enforcement readers.
The source status does not prove enforcement at critical physical access points.
Logging alone cannot establish cryptographic credential authenticity.
Normal access does not prove revocation and anti-cloning controls.
An unmanaged kiosk connects with a valid employee credential and accesses regulated workloads. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
A valid user credential does not establish a safe device or session context. A compromised compliant device can still present risk; session monitoring and least privilege matter.
User authentication is separate from endpoint posture and session risk.
Encrypted transport does not make an unmanaged endpoint trustworthy.
Client-side presentation cannot enforce device-aware resource authorization.
The organization implemented the response to this scenario: An unmanaged kiosk connects with a valid employee credential and accesses regulated workloads. The approved response was: Require conditional access evaluating user identity, device trust and resource sensitivity. Which statement MOST accurately identifies a remaining risk or constraint?
A valid user credential does not establish a safe device or session context. The same user succeeds from a trusted endpoint and is denied from an unmanaged kiosk.
Endpoint condition can change and requires bounded reassessment and monitoring.
A stolen credential or compromised device can still present a valid user principal.
Network admission alone does not establish device configuration and trust.
Management implemented a response after this event: An unmanaged kiosk connects with a valid employee credential and accesses regulated workloads. The response was: Require conditional access evaluating user identity, device trust and resource sensitivity. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
The same user succeeds from a trusted endpoint and is denied from an unmanaged kiosk. A valid user credential does not establish a safe device or session context.
User login is insufficient evidence of conditional device authorization.
Transport security cannot prove trusted resource access context.
Positive device cases cannot establish a working posture gate.
A remote onboarding service creates accounts with authority to approve financial transfers after checking only that the applicant controls a new email inbox. What control is MOST appropriate?
An email code can demonstrate control of a mailbox; it does not establish that the claimant is the specific real-world identity asserted for a high-impact privilege.
Two messages to one mailbox repeat the same possession evidence rather than establishing asserted identity.
Self-asserted account attributes cannot substantiate real-world identity or delegated transfer authority.
A user agreement does not replace adequate identity proofing for sensitive authorizations.
A bank adds stronger document and identity checks for privileged remote enrollment. Which second security boundary still requires independent controls?
Knowing that the applicant is a particular person does not automatically prove control of the intended authenticator or entitlement to perform a privileged transaction.
Unauthorized authenticator enrollment can hijack an otherwise properly proofed identity.
Identity proofing and authorization are separate decisions; job/transaction entitlements still need approval.
Weak recovery can undermine the trust established during original onboarding.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
