You save $69.98
The organization implemented the response to this scenario: An enterprise creates one custom role per employee and can no longer audit which privileges are sensitive. The approved response was: Normalize business roles with periodic review and separations, reserving exceptions for specific needs. Which statement MOST accurately identifies a remaining risk or constraint?
RBAC is easier to govern when roles correspond to stable job functions. Comparable staff share reviewed role baselines and prohibited role combinations are blocked.
Role design still needs separation-of-duties and toxic-combination checks.
Large numbers of unique roles may obscure equivalence and review ownership.
Role-to-job alignment changes and requires lifecycle reassessment.
Management implemented a response after this event: An enterprise creates one custom role per employee and can no longer audit which privileges are sensitive. The response was: Normalize business roles with periodic review and separations, reserving exceptions for specific needs. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Comparable staff share reviewed role baselines and prohibited role combinations are blocked. RBAC is easier to govern when roles correspond to stable job functions.
Role count and uniqueness do not demonstrate governable permissions.
Review completion alone cannot demonstrate effective role separation.
Successful provisioning does not show sound business-role normalization.
An employee changes her own Department identity attribute to FINANCE and immediately receives access to another unit’s payroll dataset. Which attribute-based access control change fixes the trust problem?
ABAC depends on trustworthy principal and resource attributes. If a subject can change a privileged attribute, matching policies cannot enforce the intended business boundary.
A self-asserted authorization attribute allows the user to select privileges rather than having them independently assigned.
Resource-name obscurity is not an effective attribute trust or authorization control.
Stronger authentication does not ensure authorization attributes are governed or accurate.
A company restricts ABAC session attributes to its identity provider. What additional property must be governed to prevent privilege expansion over time?
Even if principal tags are trusted initially, a user able to retag resources or retain outdated entitlements can defeat attribute matching.
Unrestricted resource-tag mutation is another path to unauthorized privilege escalation.
Role transitions require re-evaluating effective attributes and entitlements.
Authentication and the freshness/authorization of attributes are separate checks.
An organization claims ABAC prevents a developer from accessing another department’s data. Which test best verifies trusted attributes?
Negative tag-mutation and data-access tests demonstrate effective attribute governance, not just a syntactically valid match condition.
That is evidence the same attribute-spoofing defect remains.
The presence of an attribute is not proof it came from a trusted authorization authority.
Policy existence is weaker than a negative effective-permission test.
A classified intelligence system lets record creators downgrade security labels at will to share files. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
MAC restrictions are imposed by security policy, not at the whim of each data owner. Formal labels must remain consistent across copies, exports and trusted transformation paths.
Discretionary owner changes can violate mandatory clearance and information-flow policy.
Owner-distributed secrets do not enforce organization-mandated security labels.
UI concealment cannot enforce centrally governed mandatory access control.
The organization implemented the response to this scenario: A classified intelligence system lets record creators downgrade security labels at will to share files. The approved response was: Use centrally managed label and clearance enforcement rather than discretionary owner-controlled labels. Which statement MOST accurately identifies a remaining risk or constraint?
MAC restrictions are imposed by security policy, not at the whim of each data owner. An unprivileged creator cannot lower an object's classification or bypass clearance checks.
MAC labels are centrally imposed and cannot be casually downgraded.
Copies and trusted transformations must preserve or correctly mediate classification.
Write capability does not automatically imply declassification authority.
Management implemented a response after this event: A classified intelligence system lets record creators downgrade security labels at will to share files. The response was: Use centrally managed label and clearance enforcement rather than discretionary owner-controlled labels. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
An unprivileged creator cannot lower an object's classification or bypass clearance checks. MAC restrictions are imposed by security policy, not at the whim of each data owner.
The policy allows discretionary override of a mandatory restriction.
Protection fails to follow data into copies and transfers.
Policy existence is not observed central label enforcement.
A project owner is permitted to share low-risk documents but an administrator mandates central labels for all copies. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
DAC lets owners grant access, but it cannot override centrally enforced classification rules. Inherited permissions may propagate further than intended and need review.
Overly broad central denial defeats the intended controlled discretionary collaboration model.
DAC delegation cannot override centrally enforced access and clearance requirements.
Identity authentication alone cannot express bounded discretionary sharing decisions.
The organization implemented the response to this scenario: A project owner is permitted to share low-risk documents but an administrator mandates central labels for all copies. The approved response was: Use controlled discretionary permission delegation only within higher-priority mandatory constraints. Which statement MOST accurately identifies a remaining risk or constraint?
DAC lets owners grant access, but it cannot override centrally enforced classification rules. Owners can share eligible files but cannot override prohibited high-classification access.
DAC remains constrained by mandatory higher-priority policy.
Inherited grants can expand beyond the original purpose and need review.
Policies can permit bounded DAC for appropriate objects while protecting higher classifications.
Management implemented a response after this event: A project owner is permitted to share low-risk documents but an administrator mandates central labels for all copies. The response was: Use controlled discretionary permission delegation only within higher-priority mandatory constraints. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Owners can share eligible files but cannot override prohibited high-classification access. DAC lets owners grant access, but it cannot override centrally enforced classification rules.
A total ban does not implement the intended permitted discretionary access workflow.
Discretionary sharing has defeated the required central restriction.
The mechanism does not demonstrate bounded and auditable delegated permissions.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
