Question 120 A hospital calls any security tool 'compliant' without connecting it to evidence requirements. What selection process should improve? Derive confidentiality and access requirements from the data classification and threat model Map each obligation to control objectives, verification evidence and accountable owners Assess operational safety and select passive visibility or validated maintenance-window testing Assess fire detection and suppression options against occupancy and equipment hazards Explanation Correct Answer B:Control suitability includes demonstrable effectiveness and compliance evidence, not product labels. Incorrect Answers A:Choosing encryption products before requirements risks leaving real exposure paths open; although this helps when a research archive has confidential data but no defined loss scenarios, it leaves the current case's need to map each obligation to control objectives, verification evidence and accountable owners unresolved. C:A control that interrupts safety-critical equipment can create more risk than it mitigates; although this helps when a plant's industrial controller cannot tolerate active packet scanning, it leaves the current case's need to map each obligation to control objectives, verification evidence and accountable owners unresolved. D:Suppression choices must consider safety, local codes and damage to critical systems; although this helps when a fire-control proposal uses water suppression without evaluating energized equipment and people, it leaves the current case's need to map each obligation to control objectives, verification evidence and accountable owners unresolved.
Question 121 A server uses full-disk encryption, but stolen machine credentials permit access after boot. Which limitation should be recognized? Use a protected key store or hardware security module with scoped signing operations Use measured or verified boot with TPM-backed integrity evidence where supported Restore virtualization memory isolation and address the hypervisor vulnerability Strengthen authentication and protect keys because disk encryption is not a substitute for access control Explanation Correct Answer D:Encryption of storage does not prevent legitimate decryption by a compromised authorized identity. Incorrect Answers A:For the separate situation in which a server stores private signing keys in application configuration files readable by operators, nonexportable or tightly controlled keys reduce accidental disclosure from application files; here the stated problem requires strengthen authentication and protect keys because disk encryption is not a substitute for access control. B:Hardware trust anchors can report or enforce an expected boot-chain state; this responds to the different circumstance in which an application requires evidence that only approved firmware starts on endpoints, while the current case states that a server uses full-disk encryption, but stolen machine credentials permit access after boot, calling for strengthen authentication and protect keys because disk encryption is not a substitute for access control. C:The other scenario states that a hypervisor lets one guest read another guest's memory through an implementation flaw, where guest separation relies on correct privileged memory and execution protections; by contrast, the present case requires strengthen authentication and protect keys because disk encryption is not a substitute for access control.
Question 122 An application requires evidence that only approved firmware starts on endpoints. Which platform capability best helps? Restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls Use a protected key store or hardware security module with scoped signing operations Restore virtualization memory isolation and address the hypervisor vulnerability Use measured or verified boot with TPM-backed integrity evidence where supported Explanation Correct Answer D:Hardware trust anchors can report or enforce an expected boot-chain state. Incorrect Answers A:The other scenario states that a critical service accepts unauthenticated memory dumps for diagnostics in production, where memory dumps can contain plaintext credentials even when persistent disks are encrypted; by contrast, the present case requires use measured or verified boot with TPM-backed integrity evidence where supported. B:Nonexportable or tightly controlled keys reduce accidental disclosure from application files; although this helps when a server stores private signing keys in application configuration files readable by operators, it leaves the current case's need to use measured or verified boot with TPM-backed integrity evidence where supported unresolved. C:Guest separation relies on correct privileged memory and execution protections; this responds to the different circumstance in which a hypervisor lets one guest read another guest's memory through an implementation flaw, while the current case states that an application requires evidence that only approved firmware starts on endpoints, calling for use measured or verified boot with TPM-backed integrity evidence where supported.
Question 123 A hypervisor lets one guest read another guest's memory through an implementation flaw. What boundary is failing? Strengthen authentication and protect keys because disk encryption is not a substitute for access control Use measured or verified boot with TPM-backed integrity evidence where supported Restore virtualization memory isolation and address the hypervisor vulnerability Restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls Explanation Correct Answer C:Guest separation relies on correct privileged memory and execution protections. Incorrect Answers A:For the separate situation in which a server uses full-disk encryption, but stolen machine credentials permit access after boot, encryption of storage does not prevent legitimate decryption by a compromised authorized identity; here the stated problem requires restore virtualization memory isolation and address the hypervisor vulnerability. B:For the separate situation in which an application requires evidence that only approved firmware starts on endpoints, hardware trust anchors can report or enforce an expected boot-chain state; here the stated problem requires restore virtualization memory isolation and address the hypervisor vulnerability. D:Memory dumps can contain plaintext credentials even when persistent disks are encrypted; it is relevant where a critical service accepts unauthenticated memory dumps for diagnostics in production, whereas the current facts require restore virtualization memory isolation and address the hypervisor vulnerability to address the stated problem.
Question 124 A server stores private signing keys in application configuration files readable by operators. What architectural improvement reduces key exposure? Use a protected key store or hardware security module with scoped signing operations Restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls Use measured or verified boot with TPM-backed integrity evidence where supported Strengthen authentication and protect keys because disk encryption is not a substitute for access control Explanation Correct Answer A:Nonexportable or tightly controlled keys reduce accidental disclosure from application files. Incorrect Answers B:Memory dumps can contain plaintext credentials even when persistent disks are encrypted; although this helps when a critical service accepts unauthenticated memory dumps for diagnostics in production, it leaves the current case's need to use a protected key store or hardware security module with scoped signing operations unresolved. C:The other scenario states that an application requires evidence that only approved firmware starts on endpoints, where hardware trust anchors can report or enforce an expected boot-chain state; by contrast, the present case requires use a protected key store or hardware security module with scoped signing operations. D:Encryption of storage does not prevent legitimate decryption by a compromised authorized identity; this responds to the different circumstance in which a server uses full-disk encryption, but stolen machine credentials permit access after boot, while the current case states that a server stores private signing keys in application configuration files readable by operators, calling for use a protected key store or hardware security module with scoped signing operations.
Question 125 A critical service accepts unauthenticated memory dumps for diagnostics in production. What should be prioritized? Use a protected key store or hardware security module with scoped signing operations Restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls Restore virtualization memory isolation and address the hypervisor vulnerability Strengthen authentication and protect keys because disk encryption is not a substitute for access control Explanation Correct Answer B:Memory dumps can contain plaintext credentials even when persistent disks are encrypted. Incorrect Answers A:This option fits a different fact pattern where a server stores private signing keys in application configuration files readable by operators: nonexportable or tightly controlled keys reduce accidental disclosure from application files; the current case instead requires restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls. C:Guest separation relies on correct privileged memory and execution protections; it is relevant where a hypervisor lets one guest read another guest's memory through an implementation flaw, whereas the current facts require restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls to address the stated problem. D:For the separate situation in which a server uses full-disk encryption, but stolen machine credentials permit access after boot, encryption of storage does not prevent legitimate decryption by a compromised authorized identity; here the stated problem requires restrict diagnostics and protect memory-derived secrets with access, retention and sanitization controls.
Question 126 A control-system vendor proposes installing ordinary endpoint antivirus on an untested real-time controller. What should the architect evaluate? Restrict storage access using appropriate identity and network controls verified against requirements Validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe Constrain outbound destinations and validate URLs to prevent server-side request forgery Replace or isolate the device and require unique managed credentials in future acquisitions Explanation Correct Answer B:Availability and safety constraints can make standard enterprise endpoint agents unsuitable for OT. Incorrect Answers A:The other scenario states that a cloud data lake exposes its object endpoint publicly despite private application processing, where application-private compute does not automatically protect the accessible data service; by contrast, the present case requires validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe. C:This option fits a different fact pattern where a serverless function accepts attacker-controlled callback URLs and accesses internal endpoints: untrusted redirects into privileged networks can bypass intended service boundaries; the current case instead requires validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe. D:The other scenario states that an IoT gateway has a hard-coded universal password that cannot be rotated, where a shared immutable secret compromises the whole fleet when one copy leaks; by contrast, the present case requires validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe.
Question 127 A microservices platform shares one cluster-wide administrator identity across every pod. What structural risk must be reduced? Replace or isolate the device and require unique managed credentials in future acquisitions Separate workload identities and restrict service-to-service and orchestration permissions Validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe Restrict storage access using appropriate identity and network controls verified against requirements Explanation Correct Answer B:A shared privileged identity turns a single container compromise into broad lateral access. Incorrect Answers A:This option fits a different fact pattern where an IoT gateway has a hard-coded universal password that cannot be rotated: a shared immutable secret compromises the whole fleet when one copy leaks; the current case instead requires separate workload identities and restrict service-to-service and orchestration permissions. C:Availability and safety constraints can make standard enterprise endpoint agents unsuitable for OT; it is relevant where a control-system vendor proposes installing ordinary endpoint antivirus on an untested real-time controller, whereas the current facts require separate workload identities and restrict service-to-service and orchestration permissions to address the stated problem. D:This option fits a different fact pattern where a cloud data lake exposes its object endpoint publicly despite private application processing: application-private compute does not automatically protect the accessible data service; the current case instead requires separate workload identities and restrict service-to-service and orchestration permissions.
Question 128 An IoT gateway has a hard-coded universal password that cannot be rotated. What risk treatment is most appropriate? Replace or isolate the device and require unique managed credentials in future acquisitions Restrict storage access using appropriate identity and network controls verified against requirements Separate workload identities and restrict service-to-service and orchestration permissions Constrain outbound destinations and validate URLs to prevent server-side request forgery Explanation Correct Answer A:A shared immutable secret compromises the whole fleet when one copy leaks. Incorrect Answers B:Application-private compute does not automatically protect the accessible data service; although this helps when a cloud data lake exposes its object endpoint publicly despite private application processing, it leaves the current case's need to replace or isolate the device and require unique managed credentials in future acquisitions unresolved. C:This option fits a different fact pattern where a microservices platform shares one cluster-wide administrator identity across every pod: a shared privileged identity turns a single container compromise into broad lateral access; the current case instead requires replace or isolate the device and require unique managed credentials in future acquisitions. D:The other scenario states that a serverless function accepts attacker-controlled callback URLs and accesses internal endpoints, where untrusted redirects into privileged networks can bypass intended service boundaries; by contrast, the present case requires replace or isolate the device and require unique managed credentials in future acquisitions.
Question 129 A cloud data lake exposes its object endpoint publicly despite private application processing. What architecture adjustment is needed? Fix tenant isolation for shared virtual resources and test cross-session leakage Restrict storage access using appropriate identity and network controls verified against requirements Validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe Constrain outbound destinations and validate URLs to prevent server-side request forgery Explanation Correct Answer B:Application-private compute does not automatically protect the accessible data service. Incorrect Answers A:Virtualization boundaries must prevent one tenant seeing another's private data; although this helps when a virtual desktop exposes clipboard contents between isolated customer sessions, it leaves the current case's need to restrict storage access using appropriate identity and network controls verified against requirements unresolved. C:The other scenario states that a control-system vendor proposes installing ordinary endpoint antivirus on an untested real-time controller, where availability and safety constraints can make standard enterprise endpoint agents unsuitable for OT; by contrast, the present case requires restrict storage access using appropriate identity and network controls verified against requirements. D:Untrusted redirects into privileged networks can bypass intended service boundaries; this responds to the different circumstance in which a serverless function accepts attacker-controlled callback URLs and accesses internal endpoints, while the current case states that a cloud data lake exposes its object endpoint publicly despite private application processing, calling for restrict storage access using appropriate identity and network controls verified against requirements.
Question 130 A serverless function accepts attacker-controlled callback URLs and accesses internal endpoints. Which design flaw needs mitigation? Constrain outbound destinations and validate URLs to prevent server-side request forgery Replace or isolate the device and require unique managed credentials in future acquisitions Fix tenant isolation for shared virtual resources and test cross-session leakage Validate operational compatibility and use segmented compensating protections if endpoint agents are unsafe Explanation Correct Answer A:Untrusted redirects into privileged networks can bypass intended service boundaries. Incorrect Answers B:A shared immutable secret compromises the whole fleet when one copy leaks; although this helps when an IoT gateway has a hard-coded universal password that cannot be rotated, it leaves the current case's need to constrain outbound destinations and validate URLs to prevent server-side request forgery unresolved. C:The other scenario states that a virtual desktop exposes clipboard contents between isolated customer sessions, where virtualization boundaries must prevent one tenant seeing another's private data; by contrast, the present case requires constrain outbound destinations and validate URLs to prevent server-side request forgery. D:For the separate situation in which a control-system vendor proposes installing ordinary endpoint antivirus on an untested real-time controller, availability and safety constraints can make standard enterprise endpoint agents unsuitable for OT; here the stated problem requires constrain outbound destinations and validate URLs to prevent server-side request forgery.
