Question 100 A publisher wants to discourage unauthorized redistribution of licensed reports. Which protection is most relevant? Use cloud-service discovery and governance capabilities such as a CASB where appropriate Apply digital rights management with authorized licensing and recipient controls Use data loss prevention inspection with tuned classification rules and approved exceptions Define encryption scope, key custody, rotation and allowed decrypt principals Explanation Correct Answer B:DRM supports controlled use of protected content beyond network encryption alone. Incorrect Answers A:Cloud access governance identifies risky services and applies organization data-handling policy; it is relevant where teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files, whereas the current facts require apply digital rights management with authorized licensing and recipient controls to address the stated problem. C:DLP identifies or blocks risky transfers based on content and context; although this helps when a company needs to detect sensitive identifiers leaving through web uploads, it leaves the current case's need to apply digital rights management with authorized licensing and recipient controls unresolved. D:This option fits a different fact pattern where a standard mandates encryption everywhere but ignores key storage and access: effective cryptography depends on lifecycle management and authorization, not a checkbox; the current case instead requires apply digital rights management with authorized licensing and recipient controls.
Question 101 A company needs to detect sensitive identifiers leaving through web uploads. What control should it evaluate? Use data loss prevention inspection with tuned classification rules and approved exceptions Protect data in use through access isolation, process hardening and appropriate runtime controls Use cloud-service discovery and governance capabilities such as a CASB where appropriate Apply digital rights management with authorized licensing and recipient controls Explanation Correct Answer A:DLP identifies or blocks risky transfers based on content and context. Incorrect Answers B:At-rest encryption does not govern plaintext while authorized applications process it; it is relevant where a security officer encrypts database files at rest but a privileged app exposes records in clear memory, whereas the current facts require use data loss prevention inspection with tuned classification rules and approved exceptions to address the stated problem. C:Cloud access governance identifies risky services and applies organization data-handling policy; this responds to the different circumstance in which teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files, while the current case states that a company needs to detect sensitive identifiers leaving through web uploads, calling for use data loss prevention inspection with tuned classification rules and approved exceptions. D:The other scenario states that a publisher wants to discourage unauthorized redistribution of licensed reports, where dRM supports controlled use of protected content beyond network encryption alone; by contrast, the present case requires use data loss prevention inspection with tuned classification rules and approved exceptions.
Question 102 Teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files. What visibility control helps? Use data loss prevention inspection with tuned classification rules and approved exceptions Separate backup-copy access from production decryption rights and maintain audit logs Define encryption scope, key custody, rotation and allowed decrypt principals Use cloud-service discovery and governance capabilities such as a CASB where appropriate Explanation Correct Answer D:Cloud access governance identifies risky services and applies organization data-handling policy. Incorrect Answers A:For the separate situation in which a company needs to detect sensitive identifiers leaving through web uploads, dLP identifies or blocks risky transfers based on content and context; here the stated problem requires use cloud-service discovery and governance capabilities such as a CASB where appropriate. B:For the separate situation in which a backup contractor requires read access only to encrypted archives, not production records, being able to handle ciphertext need not confer permission to read its protected contents; here the stated problem requires use cloud-service discovery and governance capabilities such as a CASB where appropriate. C:Effective cryptography depends on lifecycle management and authorization, not a checkbox; although this helps when a standard mandates encryption everywhere but ignores key storage and access, it leaves the current case's need to use cloud-service discovery and governance capabilities such as a CASB where appropriate unresolved.
Question 103 A standard mandates encryption everywhere but ignores key storage and access. What must a tailored control specify? Use cloud-service discovery and governance capabilities such as a CASB where appropriate Separate backup-copy access from production decryption rights and maintain audit logs Protect data in use through access isolation, process hardening and appropriate runtime controls Define encryption scope, key custody, rotation and allowed decrypt principals Explanation Correct Answer D:Effective cryptography depends on lifecycle management and authorization, not a checkbox. Incorrect Answers A:Cloud access governance identifies risky services and applies organization data-handling policy; although this helps when teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files, it leaves the current case's need to define encryption scope, key custody, rotation and allowed decrypt principals unresolved. B:For the separate situation in which a backup contractor requires read access only to encrypted archives, not production records, being able to handle ciphertext need not confer permission to read its protected contents; here the stated problem requires define encryption scope, key custody, rotation and allowed decrypt principals. C:At-rest encryption does not govern plaintext while authorized applications process it; although this helps when a security officer encrypts database files at rest but a privileged app exposes records in clear memory, it leaves the current case's need to define encryption scope, key custody, rotation and allowed decrypt principals unresolved.
Question 104 A backup contractor requires read access only to encrypted archives, not production records. What should be scoped? Use cloud-service discovery and governance capabilities such as a CASB where appropriate Separate backup-copy access from production decryption rights and maintain audit logs Define encryption scope, key custody, rotation and allowed decrypt principals Apply digital rights management with authorized licensing and recipient controls Explanation Correct Answer B:Being able to handle ciphertext need not confer permission to read its protected contents. Incorrect Answers A:Cloud access governance identifies risky services and applies organization data-handling policy; it is relevant where teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files, whereas the current facts require separate backup-copy access from production decryption rights and maintain audit logs to address the stated problem. C:The other scenario states that a standard mandates encryption everywhere but ignores key storage and access, where effective cryptography depends on lifecycle management and authorization, not a checkbox; by contrast, the present case requires separate backup-copy access from production decryption rights and maintain audit logs. D:For the separate situation in which a publisher wants to discourage unauthorized redistribution of licensed reports, dRM supports controlled use of protected content beyond network encryption alone; here the stated problem requires separate backup-copy access from production decryption rights and maintain audit logs.
Question 105 A public API grants unrestricted admin functions until a configuration file loads. What secure-design change is needed? Simplify the control path while retaining necessary independent defense layers Document shared-responsibility boundaries for infrastructure and customer-side identity controls Minimize personal-data collection at design time and restrict unnecessary telemetry Make authorization fail closed with a deny-by-default startup state Explanation Correct Answer D:Secure defaults prevent an initialization or error condition from granting excess privilege. Incorrect Answers A:Complexity adds failure modes; defense in depth is not synonymous with duplicating every mechanism; it is relevant where an authentication system adds five complex gateways that provide identical checks and create a fragile dependency chain, whereas the current facts require make authorization fail closed with a deny-by-default startup state to address the stated problem. B:The other scenario states that a cloud workload relies on a provider's data-center encryption and assumes customer IAM is handled automatically, where provider protection of facilities does not remove customer responsibility for effective account access; by contrast, the present case requires make authorization fail closed with a deny-by-default startup state. C:For the separate situation in which a new service logs full consumer profiles by default even though only aggregate counts are needed, privacy by design reduces sensitive data before it enters logs or downstream copies; here the stated problem requires make authorization fail closed with a deny-by-default startup state.
Question 106 A healthcare service authorizes access once at the perimeter and trusts every internal request. Which architecture better contains compromise? Make authorization fail closed with a deny-by-default startup state Verify user and workload identity and authorization at each protected resource boundary Simplify the control path while retaining necessary independent defense layers Separate payment creation and approval duties across independent authorized roles Explanation Correct Answer B:Zero trust replaces implicit network location trust with explicit contextual authorization. Incorrect Answers A:For the separate situation in which a public API grants unrestricted admin functions until a configuration file loads, secure defaults prevent an initialization or error condition from granting excess privilege; here the stated problem requires verify user and workload identity and authorization at each protected resource boundary. C:The other scenario states that an authentication system adds five complex gateways that provide identical checks and create a fragile dependency chain, where complexity adds failure modes; defense in depth is not synonymous with duplicating every mechanism; by contrast, the present case requires verify user and workload identity and authorization at each protected resource boundary. D:This option fits a different fact pattern where a finance application allows the same engineer to create and approve payments: segregation of duties makes unilateral fraudulent changes harder; the current case instead requires verify user and workload identity and authorization at each protected resource boundary.
Question 107 A finance application allows the same engineer to create and approve payments. What design principle should be enforced? Separate payment creation and approval duties across independent authorized roles Simplify the control path while retaining necessary independent defense layers Minimize personal-data collection at design time and restrict unnecessary telemetry Make authorization fail closed with a deny-by-default startup state Explanation Correct Answer A:Segregation of duties makes unilateral fraudulent changes harder. Incorrect Answers B:Complexity adds failure modes; defense in depth is not synonymous with duplicating every mechanism; it is relevant where an authentication system adds five complex gateways that provide identical checks and create a fragile dependency chain, whereas the current facts require separate payment creation and approval duties across independent authorized roles to address the stated problem. C:The other scenario states that a new service logs full consumer profiles by default even though only aggregate counts are needed, where privacy by design reduces sensitive data before it enters logs or downstream copies; by contrast, the present case requires separate payment creation and approval duties across independent authorized roles. D:This option fits a different fact pattern where a public API grants unrestricted admin functions until a configuration file loads: secure defaults prevent an initialization or error condition from granting excess privilege; the current case instead requires separate payment creation and approval duties across independent authorized roles.
Question 108 A cloud workload relies on a provider's data-center encryption and assumes customer IAM is handled automatically. What should the architect clarify? Minimize personal-data collection at design time and restrict unnecessary telemetry Make authorization fail closed with a deny-by-default startup state Separate payment creation and approval duties across independent authorized roles Document shared-responsibility boundaries for infrastructure and customer-side identity controls Explanation Correct Answer D:Provider protection of facilities does not remove customer responsibility for effective account access. Incorrect Answers A:Privacy by design reduces sensitive data before it enters logs or downstream copies; although this helps when a new service logs full consumer profiles by default even though only aggregate counts are needed, it leaves the current case's need to document shared-responsibility boundaries for infrastructure and customer-side identity controls unresolved. B:The other scenario states that a public API grants unrestricted admin functions until a configuration file loads, where secure defaults prevent an initialization or error condition from granting excess privilege; by contrast, the present case requires document shared-responsibility boundaries for infrastructure and customer-side identity controls. C:Segregation of duties makes unilateral fraudulent changes harder; it is relevant where a finance application allows the same engineer to create and approve payments, whereas the current facts require document shared-responsibility boundaries for infrastructure and customer-side identity controls to address the stated problem.
Question 109 A new service logs full consumer profiles by default even though only aggregate counts are needed. What design principle applies? Minimize personal-data collection at design time and restrict unnecessary telemetry Verify user and workload identity and authorization at each protected resource boundary Separate payment creation and approval duties across independent authorized roles Make authorization fail closed with a deny-by-default startup state Explanation Correct Answer A:Privacy by design reduces sensitive data before it enters logs or downstream copies. Incorrect Answers B:This option fits a different fact pattern where a healthcare service authorizes access once at the perimeter and trusts every internal request: zero trust replaces implicit network location trust with explicit contextual authorization; the current case instead requires minimize personal-data collection at design time and restrict unnecessary telemetry. C:Segregation of duties makes unilateral fraudulent changes harder; although this helps when a finance application allows the same engineer to create and approve payments, it leaves the current case's need to minimize personal-data collection at design time and restrict unnecessary telemetry unresolved. D:For the separate situation in which a public API grants unrestricted admin functions until a configuration file loads, secure defaults prevent an initialization or error condition from granting excess privilege; here the stated problem requires minimize personal-data collection at design time and restrict unnecessary telemetry.
Question 110 An authentication system adds five complex gateways that provide identical checks and create a fragile dependency chain. What design improvement is appropriate? Simplify the control path while retaining necessary independent defense layers Minimize personal-data collection at design time and restrict unnecessary telemetry Document shared-responsibility boundaries for infrastructure and customer-side identity controls Separate payment creation and approval duties across independent authorized roles Explanation Correct Answer A:Complexity adds failure modes; defense in depth is not synonymous with duplicating every mechanism. Incorrect Answers B:For the separate situation in which a new service logs full consumer profiles by default even though only aggregate counts are needed, privacy by design reduces sensitive data before it enters logs or downstream copies; here the stated problem requires simplify the control path while retaining necessary independent defense layers. C:Provider protection of facilities does not remove customer responsibility for effective account access; although this helps when a cloud workload relies on a provider's data-center encryption and assumes customer IAM is handled automatically, it leaves the current case's need to simplify the control path while retaining necessary independent defense layers unresolved. D:Segregation of duties makes unilateral fraudulent changes harder; although this helps when a finance application allows the same engineer to create and approve payments, it leaves the current case's need to simplify the control path while retaining necessary independent defense layers unresolved.
