You save $69.98
A service switches from unsafe object deserialization to JSON with an explicit schema. What residual parser risk still needs a control?
Data-only formats prevent arbitrary object construction but remain susceptible to resource exhaustion if parser work is unbounded.
Deeply nested or huge inputs may consume excessive parser time/memory even without executable objects.
Removing validation on high-cost inputs defeats a principal safety constraint.
A schema specifies structure; business authorization must still validate requested operations and sensitive fields.
A job processor claims its untrusted-input deserialization flaw and parser exhaustion risk have been addressed. Which test best validates the change?
Negative executable-payload and resource-bound tests, plus a positive functional case, verify both safe parsing and operational limits.
A happy path does not establish safe behavior under malicious object or resource-exhaustion inputs.
Executing attacker-controlled object behavior demonstrates the unsafe deserialization path remains.
Unbounded resource use is a denial-of-service weakness despite a data-only format.
A mobile invoice API authenticates a user but lets them update another customer's invoice by changing its numeric ID. What is the BEST fix?
Authentication does not confer authority over another person's record; resource checks must be explicit.
Unpredictable identifiers reduce guessing but do not prevent misuse of a discovered ID.
Client UI rules can be bypassed through direct API requests.
Rate limits cannot reliably reject a single unauthorized object update.
The API now enforces ownership on invoice reads, but developers forget to check writes. What residual defect remains?
Read protections do not automatically mediate writes and other actions.
Identity assurance and object-level permission are distinct.
Identifier length is not an enforceable permission boundary.
Transport confidentiality cannot prevent unauthorized business object changes.
Which negative test BEST validates invoice object authorization?
Cross-account denial plus legitimate positive behavior tests the actual object authorization boundary.
A positive test cannot detect broken object-level permission checks.
Cardinality does not establish per-object caller rights.
Visual restrictions can be bypassed with direct HTTP requests.
A company rehearses server recovery but never checks whether staff can process customer orders when its primary office is closed. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Business continuity keeps essential functions operating beyond the restoration of particular IT servers. An alternate office may be inaccessible during regional emergencies, so remote and supplier assumptions need testing.
IT disaster recovery alone may omit staff, workspace, communications and suppliers.
Equipment redundancy does not restore the full business process.
Technical copies do not prove that the business can continue operating.
The organization implemented the response to this scenario: A company rehearses server recovery but never checks whether staff can process customer orders when its primary office is closed. The approved response was: Exercise alternate personnel, workspace, communications and critical suppliers as part of the business continuity plan. Which statement MOST accurately identifies a remaining risk or constraint?
Business continuity keeps essential functions operating beyond the restoration of particular IT servers. A representative order completes with alternate staff and facilities while the primary office is unavailable.
Workforce and geographic assumptions must be tested against realistic events.
Business continuity includes people, process and external dependencies.
Infrastructure recovery cannot independently validate end-to-end customer service.
Management implemented a response after this event: A company rehearses server recovery but never checks whether staff can process customer orders when its primary office is closed. The response was: Exercise alternate personnel, workspace, communications and critical suppliers as part of the business continuity plan. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A representative order completes with alternate staff and facilities while the primary office is unavailable. Business continuity keeps essential functions operating beyond the restoration of particular IT servers.
System availability alone is not business continuity success.
Facility inventory cannot demonstrate operational continuity.
Data restoration is not equivalent to maintaining the critical business transaction.
Employees open secure server-room doors for unknown visitors even though badges and CCTV record each entry. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Access logs record badge presentations but do not prove only the authorized person entered. Physical controls must support emergency egress and personnel safety rather than trapping occupants.
Badge records do not prevent unauthorized tailgating by an unbadged person.
Entry controls must preserve safe lawful emergency egress.
After-the-fact video cannot reliably prevent or respond to active unauthorized entry.
The organization implemented the response to this scenario: Employees open secure server-room doors for unknown visitors even though badges and CCTV record each entry. The approved response was: Combine supervised anti-tailgating practices, appropriate entry controls and verified visitor escort procedures. Which statement MOST accurately identifies a remaining risk or constraint?
Access logs record badge presentations but do not prove only the authorized person entered. A tailgating drill is detected and challenged without compromising emergency exit requirements.
Tailgating bypasses the one-person assumption of a swipe.
Life-safety exit requirements take priority over anti-entry constraints.
Physical controls need actual escort and anti-tailgating enforcement.
Management implemented a response after this event: Employees open secure server-room doors for unknown visitors even though badges and CCTV record each entry. The response was: Combine supervised anti-tailgating practices, appropriate entry controls and verified visitor escort procedures. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A tailgating drill is detected and challenged without compromising emergency exit requirements. Access logs record badge presentations but do not prove only the authorized person entered.
The system does not prevent or detect tailgating.
Audit logs alone cannot prove occupant-level access enforcement.
Entry prevention cannot be accepted at the cost of life-safety egress.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
