You save $69.98
Tapes holding HR records are sent to a repair contractor in unsealed packages without custody controls. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Secure storage must be maintained while media moves outside controlled facilities. Encryption does not eliminate shipment loss notifications or retention obligations.
Labels do not protect readable data when physical custody is lost.
Location tracking cannot prevent disclosure if a shipment is misdelivered.
Storage controls do not cover every handling and transit interval.
The organization implemented the response to this scenario: Tapes holding HR records are sent to a repair contractor in unsealed packages without custody controls. The approved response was: Encrypt sensitive removable media and document sealed transfers and authorized recipients. Which statement MOST accurately identifies a remaining risk or constraint?
Secure storage must be maintained while media moves outside controlled facilities. A simulated missing shipment reveals no readable records and a traceable custody gap.
Cryptography protects contents but does not eliminate retention and accountability obligations.
Packaging can be lost or opened; the stored bytes still need protection.
Custodian and recipient scope need explicit approval.
Management implemented a response after this event: Tapes holding HR records are sent to a repair contractor in unsealed packages without custody controls. The response was: Encrypt sensitive removable media and document sealed transfers and authorized recipients. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A simulated missing shipment reveals no readable records and a traceable custody gap. Secure storage must be maintained while media moves outside controlled facilities.
Successful shipping is not evidence of protected sensitive-media transfer.
Content secrecy alone does not demonstrate accountable handling.
A sticker does not verify operational transport safeguards.
Recovery backups are encrypted with keys stored only on the production system they must recover. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Backups cannot restore availability if the only decryption material is destroyed with production. Independent escrow expands key exposure and requires strong separation and testing.
A production disaster can destroy both data and the sole recovery secret.
Broad uncontrolled key distribution may allow easy recovery but creates severe confidentiality exposure.
Removing encryption trades away confidentiality rather than designing resilient key recovery.
The organization implemented the response to this scenario: Recovery backups are encrypted with keys stored only on the production system they must recover. The approved response was: Protect independently recoverable backup decryption keys under separate custodian access. Which statement MOST accurately identifies a remaining risk or constraint?
Backups cannot restore availability if the only decryption material is destroyed with production. A cold recovery can decrypt sample backups using approved secondary key custody.
Additional decrypt-capable copies require controlled access, logging and lifecycle limits.
Encrypted data needs an independently available authorized key path.
Physical and administrative common-mode risks must be considered.
Management implemented a response after this event: Recovery backups are encrypted with keys stored only on the production system they must recover. The response was: Protect independently recoverable backup decryption keys under separate custodian access. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A cold recovery can decrypt sample backups using approved secondary key custody. Backups cannot restore availability if the only decryption material is destroyed with production.
The recovery dependency was not isolated from the original failure.
Recoverability without access restriction is not safe key custody.
Backup completion does not establish usable disaster recovery.
A monitoring analyst discovers a credible sign of unauthorized payment-card data transfer. The help desk categorizes it as a routine password reset with no investigation or escalation. What is the BEST immediate management response?
Incident response needs risk-based prioritization and coordinated escalation. The event may or may not become a confirmed reportable breach, but credible exfiltration indicators should not be processed as an ordinary reset ticket.
Credential reset may be one containment action but cannot characterize data exposure or satisfy incident-management responsibilities.
Unsupported public claims can mislead affected people and impede the controlled notification process.
Destroying evidence prevents investigation, attribution and justified notification decisions.
A security operations center escalates a suspected payment-card exfiltration and begins containment. What is the MOST important decision guardrail while facts are incomplete?
Severity and notification duties depend on facts, criticality and applicable requirements. Early uncertainty warrants structured reclassification and accountable decisions, not false certainty.
A reasonable response process updates severity when new trustworthy information changes the risk estimate.
An alert is a lead; premature definitive claims may be inaccurate and differ from applicable legal thresholds.
A credible high-impact incident requires timely response, coordination and situational updates before final root cause.
After an incident playbook revision, what exercise BEST verifies that suspected payment-data exfiltration receives risk-appropriate handling?
A controlled end-to-end drill tests classification, escalation, evidence handling and evolving decision-making rather than just the existence of a playbook.
A short ticket lifetime can hide a failed escalation for high-impact incidents.
Detection volume does not demonstrate that escalation and impact-sensitive response occurred.
Lost evidence and late notification show the planned response path failed.
An infected bedside monitor is disconnected from the network without coordination, causing loss of critical patient telemetry. Malicious traffic remains a real threat. What should the security incident commander do FIRST?
For a safety-critical system, an abrupt cyber containment action can cause more immediate harm than controlled exposure. Patient care continuity and containment must be jointly managed.
Unplanned broad isolation magnifies patient-safety risk and may interrupt unrelated functioning care equipment.
Safety constraints require controlled mitigation, not indefinite acceptance of malicious communications.
Investigation needs boundaries; intentionally exposing neighboring clinical systems increases risk without an approved safety tradeoff.
Clinicians approve delayed isolation of an infected medical device until safe backup monitoring is available. What residual risk must be explicitly governed?
Deferring containment to protect patients can be warranted only with deliberate risk ownership and controls reducing ongoing compromise or lateral movement.
Specialized operational technology can still share networks and vulnerabilities; residual spread must be assessed.
A time-limited, documented safety exception needs reassessment and a plan to complete containment.
Monitoring is a key compensation for the period when the threat cannot yet be fully removed.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
