You save $69.98
The organization implemented the response to this scenario: A suspicious transaction spans server logs, firewall events and mobile-device records with inconsistent time zones. The approved response was: Normalize timestamps and account for clock skew while preserving original timestamp metadata. Which statement MOST accurately identifies a remaining risk or constraint?
Cross-source event ordering depends on time accuracy and documented conversion. A reproducible timeline shows confidence bounds and source event references.
Clock accuracy supports timing, not identity integrity when credentials may be compromised.
The original timestamp and conversion assumptions must remain available.
Collection delays and clock offsets can reorder observed events.
Management implemented a response after this event: A suspicious transaction spans server logs, firewall events and mobile-device records with inconsistent time zones. The response was: Normalize timestamps and account for clock skew while preserving original timestamp metadata. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A reproducible timeline shows confidence bounds and source event references. Cross-source event ordering depends on time accuracy and documented conversion.
Lexical order is not a reliable normalized incident chronology.
Losing provenance prevents an independent examiner from reproducing the sequence.
Collection completeness is insufficient to justify fine-grained causal ordering.
An IDS fires thousands of signature alerts without correlation to asset criticality or verified compromise. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Uncontextualized alert volume can overwhelm response and obscure meaningful incidents. Overaggressive suppression can hide low-frequency targeted attacks and needs feedback checks.
Raw alert volume overwhelms responders and hides business-relevant events.
Indiscriminate filtering can remove true low-frequency or contextual incidents.
Volume alone does not measure impact or likely compromise.
The organization implemented the response to this scenario: An IDS fires thousands of signature alerts without correlation to asset criticality or verified compromise. The approved response was: Correlate identities, assets, context and multiple signal types before prioritized escalation. Which statement MOST accurately identifies a remaining risk or constraint?
Uncontextualized alert volume can overwhelm response and obscure meaningful incidents. A replayed high-impact attack is elevated while low-context noise is appropriately triaged.
Targeted attacks may require contextual escalation despite few events.
An alert is a lead requiring triage, confidence and impact assessment.
Business criticality and corroboration matter independently of alert quantity.
Management implemented a response after this event: An IDS fires thousands of signature alerts without correlation to asset criticality or verified compromise. The response was: Correlate identities, assets, context and multiple signal types before prioritized escalation. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A replayed high-impact attack is elevated while low-context noise is appropriately triaged. Uncontextualized alert volume can overwhelm response and obscure meaningful incidents.
High-impact events remain indistinguishable from noise.
Suppressing noise at the cost of missed attacks is not effective triage.
Counting signals does not prove actionable incident correlation.
A database administrator can delete local audit logs and hide unauthorized queries. Which control BEST protects evidentiary integrity?
Independent custody reduces the subject administrator's ability to erase their own activity.
A privileged subject can erase or alter evidence under shared authority.
Encryption does not stop a privileged actor who can remove ciphertext or keys.
Eliminating logs destroys auditability rather than addressing tampering.
Centralized tamper-evident logging is deployed. Which residual operational risk remains?
Protected storage does not automatically establish complete collection or authorized visibility.
Missing or disabled source logging is a separate completeness failure.
Ordering and correlation still depend on reliable timestamps.
Sensitive records can still appear in logs and require access/retention controls.
Which red-team exercise BEST validates privileged-user audit resistance?
The test exercises both tamper resistance and telemetry completeness.
Storage presence alone cannot prove protected privileges or reliable forwarding.
Volume does not establish integrity against privileged deletion.
Unrestricted DBA deletion defeats the separation the control requires.
A workstation sends large encrypted uploads nightly to an unfamiliar domain despite normal antivirus scans. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Malicious data movement may be visible through metadata even when payload is encrypted. Legitimate backups and update traffic need contextual filtering to avoid false positives.
Flow metadata, destination and user behavior can still support investigation.
Patching is useful but does not establish whether current data movement is authorized.
An indiscriminate ban is not proportionate contextual egress control.
The organization implemented the response to this scenario: A workstation sends large encrypted uploads nightly to an unfamiliar domain despite normal antivirus scans. The approved response was: Monitor approved egress baselines and investigate destination, volume and user context. Which statement MOST accurately identifies a remaining risk or constraint?
Malicious data movement may be visible through metadata even when payload is encrypted. A controlled anomalous transfer is detected with actionable identity and destination details.
Volume, timing, destinations and identity context can still indicate abnormal transfers.
Context is necessary to avoid blocking legitimate business operations.
Malicious data movement can use allowed tools and channels.
Management implemented a response after this event: A workstation sends large encrypted uploads nightly to an unfamiliar domain despite normal antivirus scans. The response was: Monitor approved egress baselines and investigate destination, volume and user context. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A controlled anomalous transfer is detected with actionable identity and destination details. Malicious data movement may be visible through metadata even when payload is encrypted.
Missing telemetry fails the intended detection objective.
Uncontextualized thresholds cause false positives and miss real risk.
Endpoint scanner results cannot independently validate authorized data flows.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
