You save $69.98
Management implemented a response after this event: A workstation sends large encrypted uploads nightly to an unfamiliar domain despite normal antivirus scans. The response was: Monitor approved egress baselines and investigate destination, volume and user context. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A controlled anomalous transfer is detected with actionable identity and destination details. Malicious data movement may be visible through metadata even when payload is encrypted.
Missing telemetry fails the intended detection objective.
Uncontextualized thresholds cause false positives and miss real risk.
Endpoint scanner results cannot independently validate authorized data flows.
Anomaly software flags an administrator's unusual night shift as malicious without checking approved work schedules. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
An anomaly is an investigative lead, not proof of malicious intent. Insider misuse can occur during normal hours and still needs correlated evidence.
Anomaly alone can reflect approved maintenance and needs verification.
Insider misuse can occur during apparently normal schedules.
Rarity is a triage input, not proof of harmful intent.
The organization implemented the response to this scenario: Anomaly software flags an administrator's unusual night shift as malicious without checking approved work schedules. The approved response was: Correlate behavioral anomalies with contextual authorization and independently verified signals. Which statement MOST accurately identifies a remaining risk or constraint?
An anomaly is an investigative lead, not proof of malicious intent. An authorized maintenance event is cleared and a simulated privilege abuse remains detectable.
Context and known maintenance can explain many anomalies.
Authorization to work does not excuse misuse of granted privileges.
Privileged accounts may be attractive abuse paths and need contextual review.
Management implemented a response after this event: Anomaly software flags an administrator's unusual night shift as malicious without checking approved work schedules. The response was: Correlate behavioral anomalies with contextual authorization and independently verified signals. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
An authorized maintenance event is cleared and a simulated privilege abuse remains detectable. An anomaly is an investigative lead, not proof of malicious intent.
The detector lacks contextual decision-making and produces avoidable false positives.
A normal schedule must not mask malicious behavior.
An uncorroborated score is not sufficient incident evidence.
Two identical firewalls run different emergency rules months after a change window. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Consistent configuration reduces hidden exposure from unreviewed changes. Automated rollback of a valid emergency rule can create outages without change-control coordination.
Emergency and manual changes can cause drift outside the controlled configuration.
Blind rollback can remove necessary business and safety safeguards.
Hardware similarity does not establish current security configuration consistency.
The organization implemented the response to this scenario: Two identical firewalls run different emergency rules months after a change window. The approved response was: Maintain approved configuration baselines with monitored drift and controlled reconciliation. Which statement MOST accurately identifies a remaining risk or constraint?
Consistent configuration reduces hidden exposure from unreviewed changes. A drift event is attributable, reviewed and restored or formally accepted.
A valid temporary change needs decision-aware reconciliation.
Live changes can alter effective rules and security posture.
Observed configuration comparison is required to verify actual state.
Management implemented a response after this event: Two identical firewalls run different emergency rules months after a change window. The response was: Maintain approved configuration baselines with monitored drift and controlled reconciliation. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A drift event is attributable, reviewed and restored or formally accepted. Consistent configuration reduces hidden exposure from unreviewed changes.
Baseline paperwork cannot establish operational compliance.
Detection without action does not close the configuration gap.
Version matching cannot demonstrate equivalent protection.
A backup operator can both delete every recovery copy and approve the deletion evidence. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Separation of duties reduces the chance one compromised identity destroys recovery proof. Collusion and shared admin credentials can bypass nominal role separation.
One compromised principal can destroy both recoverability and its audit trail.
Shared authority prevents meaningful separation or individual attribution.
Documentation cannot replace effective independent destructive-action authorization.
A backup organization formally splits deletion requests and approvals between two people, but both roles still use one shared root account capable of erasing the production and off-site recovery copies. Which remaining control failure is MOST significant?
Separate duties must be implemented as actual distinct authorizations, protected backup custody and user-specific privileged identities, not merely administrative role labels.
A shared privileged identity can perform all operations and obscures attribution; role names alone do not enforce separation.
Audit logs may document misuse but do not technically restrict a root credential with destructive authority.
The security boundary concerns effective backup deletion and recovery custody, which an unrelated approval cannot protect.
Management implemented a response after this event: A backup operator can both delete every recovery copy and approve the deletion evidence. The response was: Separate destructive authority and approval, with protected logs and recovery custody. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
One operator cannot both authorize and perform bulk backup deletion. Separation of duties reduces the chance one compromised identity destroys recovery proof.
The tested action violates the intended separation of authority.
Traceability does not prove independent destructive-action control.
Paper separation is ineffective when enforcement can be bypassed.
Tapes holding HR records are sent to a repair contractor in unsealed packages without custody controls. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Secure storage must be maintained while media moves outside controlled facilities. Encryption does not eliminate shipment loss notifications or retention obligations.
Labels do not protect readable data when physical custody is lost.
Location tracking cannot prevent disclosure if a shipment is misdelivered.
Storage controls do not cover every handling and transit interval.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
