You save $69.98
A bank adds stronger document and identity checks for privileged remote enrollment. Which second security boundary still requires independent controls?
Knowing that the applicant is a particular person does not automatically prove control of the intended authenticator or entitlement to perform a privileged transaction.
Unauthorized authenticator enrollment can hijack an otherwise properly proofed identity.
Identity proofing and authorization are separate decisions; job/transaction entitlements still need approval.
Weak recovery can undermine the trust established during original onboarding.
A remote enrollment program claims privileged users are identity-proofed rather than merely email-verified. Which test BEST substantiates that claim?
A negative fraudulent enrollment plus valid positive case shows identity proofing and authenticator binding are distinct and effective.
Mailbox control alone is the exact weak assurance the updated process was intended to remove.
Post-enrollment login success cannot establish the identity of the person who enrolled.
String-format validation has no relationship to proving an asserted real-world identity.
Attackers trick employees into approving repeated push MFA requests and relay credentials through an adversary-controlled lookalike website. Which authentication change most directly resists this attack path?
An origin-bound authenticator will not create a valid assertion for the genuine service when used on an attacker origin. Number matching improves some push flows but is not equivalent to cryptographic phishing resistance.
More notifications intensify push fatigue and do not bind authentication to the genuine service origin.
Password rotation alone does not prevent adversary-in-the-middle credential capture or induced push approval.
Visual branding can be copied by phishers and does not cryptographically bind a login to its legitimate origin.
A company has rolled out phishing-resistant authenticators for employees. What residual pathway MUST receive equivalent assurance so attackers cannot bypass the new sign-in method?
A phishing-resistant primary login can be undermined by weaker recovery, rebinding or fallback factors. The assurance chain includes registration and loss handling.
Publicly discoverable knowledge is inadequate proof of identity for high-assurance recovery.
An unrestricted weaker fallback reintroduces the exact push-fatigue compromise path the stronger factor was meant to close.
Unreviewed rebinding enables social-engineered account takeover even though the normal login is phishing resistant.
After deploying FIDO2/WebAuthn for privileged employees, which security exercise BEST demonstrates resistance to a credential-relay phishing site?
WebAuthn signatures are scoped to relying-party identity/origin, providing direct evidence of phishing resistance when validated by the server.
This fails to test the origin-bound cryptographic authentication step at risk.
Successful attacker-site relay indicates the old weak path remains usable; it is not evidence of resistance.
Registration coverage is deployment evidence, not a test that phishing-origin assertions are rejected.
Several administrators share a root password in a team chat. What control most directly improves secret custody and individual accountability?
Central custody and traceable individual use reduce uncontrolled copies and shared-account ambiguity.
Easier sharing increases persistent exposure and weakens access attribution.
A label does not enforce password custody, rotation or command accountability.
Unmanaged shared credentials remain an effective bypass of identity-level controls.
The root credential now requires approved vault checkout. What risk still requires investigation?
Session recording, rotation, role separation and monitoring supplement custody controls.
Vault enforcement limits credential exposure, not every authorized activity after disclosure.
Entropy and individual attribution address different properties.
Rotation is normally beneficial when governed for dependent systems and recovery.
Which demonstration BEST validates a shared-secret vault migration?
This checks credential revocation and accountable use instead of merely purchasing a vault.
Billing evidence cannot prove old credentials are revoked or sessions attributable.
A working interface does not prove approval, rotation or session capture.
Awareness cannot substitute for enforceable secret custody and revocation.
An application keeps the same unauthenticated session identifier after a user signs in with MFA. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Keeping an attacker-known pre-login ID allows session fixation despite successful MFA. Session token theft after login remains a separate risk requiring secure transport and expiry.
An attacker who fixed or learned the old ID may inherit the authenticated session.
Credential quality does not fix a session identifier known before authentication.
Obscuring tokens does not remove fixation across privilege transitions.
The organization implemented the response to this scenario: An application keeps the same unauthenticated session identifier after a user signs in with MFA. The approved response was: Rotate session identifiers on authentication and privilege transitions with secure cookie controls. Which statement MOST accurately identifies a remaining risk or constraint?
Keeping an attacker-known pre-login ID allows session fixation despite successful MFA. A pre-login token becomes invalid after sign-in and no longer grants the authenticated session.
Post-login token compromise remains a separate transport and expiry risk.
MFA proves authentication, but the application must explicitly rekey its session.
Cookie naming does not invalidate a pre-set authenticated session identifier.
Management implemented a response after this event: An application keeps the same unauthenticated session identifier after a user signs in with MFA. The response was: Rotate session identifiers on authentication and privilege transitions with secure cookie controls. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A pre-login token becomes invalid after sign-in and no longer grants the authenticated session. Keeping an attacker-known pre-login ID allows session fixation despite successful MFA.
A fixed session identifier has improperly crossed the authentication boundary.
Successful MFA alone cannot demonstrate safe session regeneration.
Visible identity changes do not prove invalidation of attacker-known tokens.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
