You save $69.98
Management implemented a response after this event: A hospital's recovery database is ready but patient access fails because its external identity provider is unavailable. The response was: Include external authentication and communication dependencies in continuity planning and recovery exercises. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
End-to-end patient login and record retrieval pass an outage test despite a provider disruption. Technical recovery of local compute is not complete business-process availability.
Backup health is not end-to-end patient service availability.
Supplier statistics cannot validate the organization’s actual dependent workflow under failure.
A technical database probe bypasses the affected identity and application dependencies.
A departing contractor's SSO account is disabled but long-lived API tokens and badge access still work. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Offboarding must remove all effective access paths, not just interactive directory login. Shared service accounts must not be deleted blindly if they support production workflows.
API tokens and badges can continue to work independently of an interactive account.
Indiscriminate deletion can cause outages and still leave personal long-lived tokens unrevoked.
Delayed lifecycle action leaves a departing identity with effective access.
The organization implemented the response to this scenario: A departing contractor's SSO account is disabled but long-lived API tokens and badge access still work. The approved response was: Coordinate HR-triggered identity, token, device and physical-access revocation with owner verification. Which statement MOST accurately identifies a remaining risk or constraint?
Offboarding must remove all effective access paths, not just interactive directory login. Post-termination negative login, API and badge tests prove access removal across systems.
Independent credentials and readers may not check the current directory revocation state.
Shared production accounts require reassignment and review rather than blindly destructive revocation.
Actual token, device and physical authorization need explicit reconciliation and tests.
Management implemented a response after this event: A departing contractor's SSO account is disabled but long-lived API tokens and badge access still work. The response was: Coordinate HR-triggered identity, token, device and physical-access revocation with owner verification. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Post-termination negative login, API and badge tests prove access removal across systems. Offboarding must remove all effective access paths, not just interactive directory login.
A single directory flag does not prove effective removal of delegated credentials.
Employment status is not evidence that physical enforcement has been updated.
A negative interactive login alone omits noninteractive and persistent access routes.
An administrator moves to an analyst role but retains approval and production deployment privileges. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Least privilege and separation of duties apply when roles change, not only on termination. Exception approval for a transition must be narrowly timed and monitored.
Dormant privileged rights after a role transfer violate least privilege and separation of duties.
Accumulating entitlements does not remove dangerous combined role capabilities.
Unnecessary account destruction can disrupt legitimate work without role-appropriate reprovisioning.
The organization implemented the response to this scenario: An administrator moves to an analyst role but retains approval and production deployment privileges. The approved response was: Reprovision access for the new role and revoke conflicting privileges through the transfer workflow. Which statement MOST accurately identifies a remaining risk or constraint?
Least privilege and separation of duties apply when roles change, not only on termination. Entitlement diff shows old privileged groups removed and new analyst access tested.
Temporary elevated rights need an explicit expiration and accountable monitoring.
Inherited approvals can conflict with new analyst access and still require control.
Granting entitlements does not imply revocation of existing role memberships.
Management implemented a response after this event: An administrator moves to an analyst role but retains approval and production deployment privileges. The response was: Reprovision access for the new role and revoke conflicting privileges through the transfer workflow. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Entitlement diff shows old privileged groups removed and new analyst access tested. Least privilege and separation of duties apply when roles change, not only on termination.
Positive testing of a new role does not prove excessive legacy authority was revoked.
A personnel event alone cannot establish the effective access transition.
Low usage does not demonstrate removal of incompatible privileges.
Operations accepts a major payment-fraud residual risk even though only the product owner can sign business exposure. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Risk acceptance is a management decision about business impact rather than a unilateral IT override. Changes in fraud frequency or exposure may invalidate an earlier authorized decision.
Technical administration does not transfer business risk acceptance authority.
A technical severity score does not authorize accepting business fraud exposure.
An adviser cannot replace the accountable internal business risk owner.
The organization implemented the response to this scenario: Operations accepts a major payment-fraud residual risk even though only the product owner can sign business exposure. The approved response was: Escalate residual-risk treatment to the authorized business risk owner for time-bound documented acceptance. Which statement MOST accurately identifies a remaining risk or constraint?
Risk acceptance is a management decision about business impact rather than a unilateral IT override. The risk register names risk owner, quantified exposure, acceptance boundaries and review trigger.
Material exposure changes can exceed the original risk appetite and require reassessment.
Authority must match the documented business risk decision rights.
A control may reduce but not eliminate fraud risk or accountable acceptance.
Management implemented a response after this event: Operations accepts a major payment-fraud residual risk even though only the product owner can sign business exposure. The response was: Escalate residual-risk treatment to the authorized business risk owner for time-bound documented acceptance. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
The risk register names risk owner, quantified exposure, acceptance boundaries and review trigger. Risk acceptance is a management decision about business impact rather than a unilateral IT override.
Ticket closure cannot demonstrate authorized management acceptance.
Alert volume does not establish the scope of an accepted fraud risk.
Aggregate status does not provide specific accountable approval of residual business loss.
An organization estimates that a particular security incident would cost $200,000 and has an annualized occurrence rate of 0.25. For an initial quantitative risk comparison, what is the expected annualized loss expectancy (ALE)?
ALE is SLE × ARO. Here $200,000 × 0.25 = $50,000 expected loss per year. It is an estimate based on modeled frequency and impact, not a guaranteed annual invoice.
This is the single-loss expectancy (SLE) for one event, not the annualized value for an estimated quarter of an event per year.
Dividing SLE by 0.25 reverses the annualization operation and overstates the modeled annual expectation.
Adding an event rate to the cost is dimensionally invalid; annualized loss multiplies expected frequency by event loss.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
