You save $69.98
Quarterly access reviews approve all entitlements without managers seeing actual privileges or use history. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Rubber-stamp reviews do not demonstrate that permissions remain appropriate. Historical usage alone can omit rare emergency tasks and must be contextualized.
A rubber-stamp workflow cannot substantiate business necessity and least privilege.
Some legitimate emergency permissions require contextual assessment rather than blind usage rules.
Role labels do not reveal accumulated privileges or toxic combinations.
The organization implemented the response to this scenario: Quarterly access reviews approve all entitlements without managers seeing actual privileges or use history. The approved response was: Give accountable data/system owners meaningful privilege evidence and enforce revocation decisions. Which statement MOST accurately identifies a remaining risk or constraint?
Rubber-stamp reviews do not demonstrate that permissions remain appropriate. Review records identify specific privileges, business justification and completed removals.
Rare authorized duties can be valid and need accountable contextual justification.
Approval without meaningful evidence is not effective certification.
Decision records still need implemented revocation and negative tests.
Management implemented a response after this event: Quarterly access reviews approve all entitlements without managers seeing actual privileges or use history. The response was: Give accountable data/system owners meaningful privilege evidence and enforce revocation decisions. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Review records identify specific privileges, business justification and completed removals. Rubber-stamp reviews do not demonstrate that permissions remain appropriate.
Completion counts do not demonstrate reasoned access decisions.
Workflow closure is not evidence that revocation was enforced.
Personal familiarity does not establish role-appropriate entitlement review.
A support engineer has permanent domain admin rights for tasks that require them twice a month. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Standing privileges increase the attack window beyond the actual maintenance need. Elevation controls must prevent users from self-approving their own privileged requests.
Standing elevation creates unnecessary attack exposure outside maintenance windows.
Shared credential access obscures identity and bypasses just-in-time governance.
UI visibility does not revoke effective broad entitlements.
The organization implemented the response to this scenario: A support engineer has permanent domain admin rights for tasks that require them twice a month. The approved response was: Implement just-in-time elevation with explicit approval, strong authentication and session accountability. Which statement MOST accurately identifies a remaining risk or constraint?
Standing privileges increase the attack window beyond the actual maintenance need. The engineer's normal session cannot perform admin tasks; approved elevated access expires automatically.
Approval must be independently authorized to provide meaningful control.
Granted temporary authority can still be abused and requires scope and monitoring.
Exposure duration matters even when legitimate use is infrequent.
Management implemented a response after this event: A support engineer has permanent domain admin rights for tasks that require them twice a month. The response was: Implement just-in-time elevation with explicit approval, strong authentication and session accountability. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
The engineer's normal session cannot perform admin tasks; approved elevated access expires automatically. Standing privileges increase the attack window beyond the actual maintenance need.
Standing privileges are still active rather than time bounded.
Self-approval and missing expiry defeat time-bounded governance.
Activity counts do not establish accountability for temporary human privilege.
Application accounts share one permanent credential across 40 microservices, making rotation disruptive. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Shared machine credentials conceal accountability and expand compromise scope. Rotation processes need rollback and availability safeguards to avoid service outages.
Shared secrets create broad compromise scope and disruptive emergency rotation.
Distribution into separate containers does not create separated access identities.
Unbounded permissions increase blast radius across unrelated workloads.
The organization implemented the response to this scenario: Application accounts share one permanent credential across 40 microservices, making rotation disruptive. The approved response was: Assign individual service identities, restrict allowed operations and automate credential/key rotation with dependency testing. Which statement MOST accurately identifies a remaining risk or constraint?
Shared machine credentials conceal accountability and expand compromise scope. Revoking one service's identity does not break unrelated applications.
Credential lifecycle changes need coordinated availability and rollback handling.
A common principal cannot enforce service-specific accountability or revocation.
Expiration limits time, not the breadth of privileges during validity.
Management implemented a response after this event: Application accounts share one permanent credential across 40 microservices, making rotation disruptive. The response was: Assign individual service identities, restrict allowed operations and automate credential/key rotation with dependency testing. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Revoking one service's identity does not break unrelated applications. Shared machine credentials conceal accountability and expand compromise scope.
The test demonstrates unsafe shared machine identity rather than isolation.
A rotation event that disrupts necessary applications is not successful lifecycle governance.
Labels do not show individually scoped and attributable principals.
A contractor receives a production VPN account with no expiration even though the work order lasts four days. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Externally sponsored access should not outlive the approved business relationship. Extending access needs a new documented sponsor decision, not indefinite idle status.
Authorization should end with the approved sponsorship and work period.
Shared broad identity cannot express individual sponsorship or least privilege.
Periodic review is too delayed for explicitly time-limited external access.
The organization implemented the response to this scenario: A contractor receives a production VPN account with no expiration even though the work order lasts four days. The approved response was: Time-bound provisioning to verified sponsorship and automatic removal at contract completion. Which statement MOST accurately identifies a remaining risk or constraint?
Externally sponsored access should not outlive the approved business relationship. The contractor can reach only assigned systems during the four-day authorization period.
Access must be bounded by the relationship and approved business purpose.
Extensions require renewed accountable sponsorship and scoped privileges.
Tunnel security does not automatically restrict reachable application services.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
