You save $69.98
The organization implemented the response to this scenario: A contractor receives a production VPN account with no expiration even though the work order lasts four days. The approved response was: Time-bound provisioning to verified sponsorship and automatic removal at contract completion. Which statement MOST accurately identifies a remaining risk or constraint?
Externally sponsored access should not outlive the approved business relationship. The contractor can reach only assigned systems during the four-day authorization period.
Access must be bounded by the relationship and approved business purpose.
Extensions require renewed accountable sponsorship and scoped privileges.
Tunnel security does not automatically restrict reachable application services.
Management implemented a response after this event: A contractor receives a production VPN account with no expiration even though the work order lasts four days. The response was: Time-bound provisioning to verified sponsorship and automatic removal at contract completion. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
The contractor can reach only assigned systems during the four-day authorization period. Externally sponsored access should not outlive the approved business relationship.
The account lacks effective expiry and lifecycle revocation.
Sponsorship existence is not proof of resource-appropriate least privilege.
Documented deadlines without enforced expiry cannot demonstrate bounded access.
A terminated employee's Kerberos ticket continues to authorize privileged service access for hours. Which design improvement most directly limits this exposure?
Kerberos tickets can remain valid until expiry; critical services may need fresh account-status evaluation.
Ticket validity and account revocation are not inherently identical events.
Longer lifetimes extend replay or stale-access windows.
Kerberos authentication depends on time bounds and synchronized clocks to resist replay.
Short-lived Kerberos tickets reduce offboarding exposure. What remaining issue should operations anticipate?
Security bounds require balancing renewal capacity and residual stale grants.
Cryptographic ticket protection does not automatically propagate live revocation.
Credential lifetime should reflect exposure and supported service requirements.
Kerberos explicitly has time-based ticket validity and replay defenses.
What simulation BEST verifies the privileged-service termination bound?
Measures real stale-credential behavior rather than assuming immediate propagation.
A workflow ticket does not demonstrate service authorization outcomes.
KDC availability alone cannot prove revocation behavior at resource services.
Configuration inspection misses stale caches and enforcement failures.
A stolen hardware authenticator remains registered after a user reports loss. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Account assurance depends on promptly invalidating compromised authenticators, not just resetting a password. Alternate recovery factors must be checked for compromise and misuse.
Password rotation cannot revoke an independently valid possession factor.
Multiple valid authenticators leave the stolen device a working access path.
A lost registered authenticator still needs lifecycle revocation and secure recovery.
The organization implemented the response to this scenario: A stolen hardware authenticator remains registered after a user reports loss. The approved response was: Revoke the bound authenticator, require secure recovery and register a replacement with identity checks. Which statement MOST accurately identifies a remaining risk or constraint?
Account assurance depends on promptly invalidating compromised authenticators, not just resetting a password. Lost authenticators fail subsequent logins while newly bound approved factors succeed.
Passkeys and physical authenticators may remain independently bound to the account.
All effective credential recovery paths need appropriate reassessment.
Reporting initiates but does not itself enforce authenticator invalidation.
Management implemented a response after this event: A stolen hardware authenticator remains registered after a user reports loss. The response was: Revoke the bound authenticator, require secure recovery and register a replacement with identity checks. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Lost authenticators fail subsequent logins while newly bound approved factors succeed. Account assurance depends on promptly invalidating compromised authenticators, not just resetting a password.
Successful replacement does not prove old-factor revocation.
Password lifecycle and authenticator lifecycle are distinct.
Administrative closure is not effective revocation evidence.
Service-to-service requests use TLS for server identity but the receiver cannot distinguish authorized workload clients. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Server TLS prevents impostor servers but does not by itself authenticate calling services. Certificate issuance and revocation must be governed to avoid broad shared client identities.
One-way TLS authenticates the server to its client but need not authenticate the client workload.
Network location alone cannot establish the specific calling service identity.
Shared credentials obscure principals and enable unauthorized cross-service invocation.
The organization implemented the response to this scenario: Service-to-service requests use TLS for server identity but the receiver cannot distinguish authorized workload clients. The approved response was: Require mutual authentication and bind validated client identities to service-level authorization. Which statement MOST accurately identifies a remaining risk or constraint?
Server TLS prevents impostor servers but does not by itself authenticate calling services. An unauthorized client certificate is rejected and approved workload identity is least-privileged.
Client authentication still needs service-specific resource and method authorization.
Workload identities need revocation, rotation and lifecycle governance.
Protected transport alone does not assert least-privilege caller permissions.
Management implemented a response after this event: Service-to-service requests use TLS for server identity but the receiver cannot distinguish authorized workload clients. The response was: Require mutual authentication and bind validated client identities to service-level authorization. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
An unauthorized client certificate is rejected and approved workload identity is least-privileged. Server TLS prevents impostor servers but does not by itself authenticate calling services.
Server-only authentication has not enforced the workload caller boundary.
Cryptographic client proof without scoped authorization is insufficient.
Cipher-suite health cannot establish service-to-service least privilege.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
