You save $69.98
Management implemented a response after this event: A team only tests deployed HTTP behavior and misses unsafe file-handling code in unused branches. The response was: Combine source-focused security review or SAST with runtime tests aligned to threat models. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A source-only vulnerability is found and an exploitable runtime path is confirmed separately. Static and dynamic testing reveal different classes of defects and coverage gaps.
Runtime-only success does not prove unexecuted code is safe.
Static hits alone do not establish exploitable operational outcomes.
A checklist of tools is not tested coverage evidence.
An image-processing service passes normal unit tests but crashes on malformed binary headers from users. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Unexpected inputs expose parser crashes and memory-corruption behavior absent from happy-path tests. A crash is not automatically exploitable, so impact and reachability must be evaluated.
Happy-path inputs cannot explore malformed-header and memory-safety behaviors.
File-name checks do not validate internal lengths, magic bytes or malformed structures.
Removing visibility cannot eliminate memory errors from adversarial inputs.
The organization implemented the response to this scenario: An image-processing service passes normal unit tests but crashes on malformed binary headers from users. The approved response was: Use mutation/generation fuzzing with sanitizers and triage reproducible failures. Which statement MOST accurately identifies a remaining risk or constraint?
Unexpected inputs expose parser crashes and memory-corruption behavior absent from happy-path tests. Malformed-input regression tests no longer crash and retain supported image functionality.
Crashes require reachability, exploitability and impact triage.
Normal tests often miss hostile length fields and parser state combinations.
Diagnostics and reliable reproduction are needed to understand failure severity.
Management implemented a response after this event: An image-processing service passes normal unit tests but crashes on malformed binary headers from users. The response was: Use mutation/generation fuzzing with sanitizers and triage reproducible failures. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Malformed-input regression tests no longer crash and retain supported image functionality. Unexpected inputs expose parser crashes and memory-corruption behavior absent from happy-path tests.
Positive decoding tests cannot establish adversarial parser robustness.
Fuzzing activity alone is not remediation effectiveness.
Filename checks cannot substitute for safe binary processing tests.
A banking API validates user login but accepts an arbitrary account_id in a transaction-update request. A normal customer can change another customer’s record by modifying that parameter. What server-side correction BEST prevents this?
Authentication establishes identity; object-level authorization must be enforced at the resource on every read/write request. An unguessable ID is not an access-control decision.
Unpredictable references slow guessing but a leaked identifier would still grant unauthorized access.
An attacker can call the API directly; authorization must be enforced on the server independently of UI visibility.
Stronger authentication does not prevent an authenticated customer from requesting someone else’s record.
An engineering team hides cross-account buttons in its banking web interface and implements a server-side authorization middleware. Which remaining assumption MUST be verified?
A good policy cannot protect bypassable routes. Complete mediation and negative cross-principal tests must cover all interfaces, not just the obvious UI button.
Identifier length is not permission enforcement and does not protect exposed IDs.
CORS is a browser-origin mechanism, not a general substitute for server-side resource authorization.
Rate limits can slow attacks but do not decide whether an individual transaction is authorized.
A banking API team claims to have fixed cross-customer account modification. Which test result BEST confirms the control?
Positive own-resource and negative other-resource tests directly exercise object-level authorization at the API and detect insecure direct-object references.
Authentication assurance says nothing about unauthorized access between authenticated customers.
A direct-request bypass demonstrates the authorization defect remains exploitable.
Unpredictability is defense in depth, not proof of enforced resource authorization.
An independent assessor tests whether emergency firewall changes left any systems outside the approved baseline. Which assessment design BEST demonstrates continued configuration compliance after changes?
Compliance assurance requires examining the actual effective configuration after change, not relying on the original deployment record. Representative scope, approved exceptions and observed remediation distinguish independent assessment from routine operational drift handling.
One-time compliance cannot detect configuration drift after deployment.
Blind automation can reverse necessary approved changes and cause outages.
Asset visibility does not prove baseline conformity over time.
The assessor samples a changed firewall fleet and finds control drift. Which weakness in the assessment plan is MOST important to acknowledge before declaring the full fleet compliant?
An assessor cannot generalize from a convenience sample to all devices without defining the population and selection limits. This is an assurance coverage decision rather than a decision about how operations should roll back an individual firewall.
A valid exception may be essential for service and needs controlled review.
Operational modifications can invalidate the deployed configuration later.
Actual configuration must be measured against the approved policy.
An independent compliance review follows emergency configuration changes. Which evidence BEST supports an audit conclusion that required controls remain enforced across the assessed population?
Population coverage, effective-state comparison, authorized exceptions and remediation retesting together demonstrate independent compliance assurance rather than simply reporting a configuration drift alert.
Initial approval does not demonstrate ongoing baseline enforcement.
Detection alone is not complete monitored compliance treatment.
Declared similarity is not configuration-state evidence.
A dashboard reports how many firewalls were installed rather than how often unauthorized connections succeed. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Activity measures can look healthy while business risk remains unacceptable. A single risk indicator may be noisy and needs thresholds, owners and trend analysis.
Deployment activity is not an outcome metric for effective access denial.
Work throughput cannot substitute for actual exposure and control failure indicators.
Suppressing adverse signals hides rather than reduces the business threat.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
