Question 140 A hardware attacker measures power use during protected private-key operations. What threat should architects assess? Treat the observation as a timing side-channel and use constant-time verification Invalidate compromised sessions and strengthen replay-resistant session lifecycle controls Apply side-channel resistance and physical protections to the cryptographic implementation Eliminate distinguishable decryption errors that enable padding-oracle or chosen-ciphertext exploitation Explanation Correct Answer C:Power analysis can expose sensitive intermediate states despite mathematically sound algorithms. Incorrect Answers A:Timing differences can disclose secret-dependent computations without directly breaking the cipher; although this helps when a web service verifies API HMACs using early-exit string comparison and response timing leaks matching prefix length, it leaves the current case's need to apply side-channel resistance and physical protections to the cryptographic implementation unresolved. B:A stolen bearer token may remain usable independently of the original password; it is relevant where a service accepts a stolen session token despite the user changing their password, whereas the current facts require apply side-channel resistance and physical protections to the cryptographic implementation to address the stated problem. D:Error oracles can reveal plaintext information from crafted ciphertext queries; although this helps when an encryption library reveals different errors for invalid padding versus invalid authentication data, it leaves the current case's need to apply side-channel resistance and physical protections to the cryptographic implementation unresolved.
Question 141 A service accepts a stolen session token despite the user changing their password. What class of compromise should be addressed? Verify user and workload identity and authorization at each protected resource boundary Implement bounded attempts and appropriate throttling or lockout for online brute-force attempts Invalidate compromised sessions and strengthen replay-resistant session lifecycle controls Eliminate distinguishable decryption errors that enable padding-oracle or chosen-ciphertext exploitation Explanation Correct Answer C:A stolen bearer token may remain usable independently of the original password. Incorrect Answers A:Zero trust replaces implicit network location trust with explicit contextual authorization; it is relevant where a healthcare service authorizes access once at the perimeter and trusts every internal request, whereas the current facts require invalidate compromised sessions and strengthen replay-resistant session lifecycle controls to address the stated problem. B:Online guessing cost depends on enforced rate limits and account controls; although this helps when an attacker can make repeated guesses against a poorly protected four-digit PIN, it leaves the current case's need to invalidate compromised sessions and strengthen replay-resistant session lifecycle controls unresolved. D:Error oracles can reveal plaintext information from crafted ciphertext queries; it is relevant where an encryption library reveals different errors for invalid padding versus invalid authentication data, whereas the current facts require invalidate compromised sessions and strengthen replay-resistant session lifecycle controls to address the stated problem.
Question 142 A flood-prone facility houses an essential network hub in a basement. What site-design change should be considered first? Evaluate fire, thermal and environmental exposure before approving the facility layout Relocate critical equipment or establish flood-resistant elevation and continuity measures Select recovery locations with genuinely independent regional and utility failure risks Zone the building with progressively restricted physical access boundaries Explanation Correct Answer B:Location hazards must inform facility placement, not just electronic access controls. Incorrect Answers A:Physical environment can defeat logical controls and destroy irreplaceable records; it is relevant where a records vault will sit next to a high-heat manufacturing process, whereas the current facts require relocate critical equipment or establish flood-resistant elevation and continuity measures to address the stated problem. C:For the separate situation in which a proposed backup site shares the same floodplain and power substation as the main site, geographical proximity or common utilities can defeat intended recovery independence; here the stated problem requires relocate critical equipment or establish flood-resistant elevation and continuity measures. D:This option fits a different fact pattern where an operations room's security perimeter ends at the front door, but visitor access reaches server aisles: facility design should isolate sensitive areas beyond a single outer entrance; the current case instead requires relocate critical equipment or establish flood-resistant elevation and continuity measures.
Question 143 A new data center has a single public road and no alternate emergency access. What should security architecture assess? Evaluate fire, thermal and environmental exposure before approving the facility layout Zone the building with progressively restricted physical access boundaries Select recovery locations with genuinely independent regional and utility failure risks Include physical access dependency and evacuation resilience in the site threat assessment Explanation Correct Answer D:Site selection must consider human safety and logistics during emergencies. Incorrect Answers A:Physical environment can defeat logical controls and destroy irreplaceable records; it is relevant where a records vault will sit next to a high-heat manufacturing process, whereas the current facts require include physical access dependency and evacuation resilience in the site threat assessment to address the stated problem. B:The other scenario states that an operations room's security perimeter ends at the front door, but visitor access reaches server aisles, where facility design should isolate sensitive areas beyond a single outer entrance; by contrast, the present case requires include physical access dependency and evacuation resilience in the site threat assessment. C:Geographical proximity or common utilities can defeat intended recovery independence; although this helps when a proposed backup site shares the same floodplain and power substation as the main site, it leaves the current case's need to include physical access dependency and evacuation resilience in the site threat assessment unresolved.
Question 144 A records vault will sit next to a high-heat manufacturing process. What hazard planning is needed? Include physical access dependency and evacuation resilience in the site threat assessment Evaluate fire, thermal and environmental exposure before approving the facility layout Relocate critical equipment or establish flood-resistant elevation and continuity measures Select recovery locations with genuinely independent regional and utility failure risks Explanation Correct Answer B:Physical environment can defeat logical controls and destroy irreplaceable records. Incorrect Answers A:For the separate situation in which a new data center has a single public road and no alternate emergency access, site selection must consider human safety and logistics during emergencies; here the stated problem requires evaluate fire, thermal and environmental exposure before approving the facility layout. C:Location hazards must inform facility placement, not just electronic access controls; this responds to the different circumstance in which a flood-prone facility houses an essential network hub in a basement, while the current case states that a records vault will sit next to a high-heat manufacturing process, calling for evaluate fire, thermal and environmental exposure before approving the facility layout. D:The other scenario states that a proposed backup site shares the same floodplain and power substation as the main site, where geographical proximity or common utilities can defeat intended recovery independence; by contrast, the present case requires evaluate fire, thermal and environmental exposure before approving the facility layout.
Question 145 An operations room's security perimeter ends at the front door, but visitor access reaches server aisles. What design correction is required? Zone the building with progressively restricted physical access boundaries Select recovery locations with genuinely independent regional and utility failure risks Include physical access dependency and evacuation resilience in the site threat assessment Relocate critical equipment or establish flood-resistant elevation and continuity measures Explanation Correct Answer A:Facility design should isolate sensitive areas beyond a single outer entrance. Incorrect Answers B:The other scenario states that a proposed backup site shares the same floodplain and power substation as the main site, where geographical proximity or common utilities can defeat intended recovery independence; by contrast, the present case requires zone the building with progressively restricted physical access boundaries. C:Site selection must consider human safety and logistics during emergencies; it is relevant where a new data center has a single public road and no alternate emergency access, whereas the current facts require zone the building with progressively restricted physical access boundaries to address the stated problem. D:Location hazards must inform facility placement, not just electronic access controls; although this helps when a flood-prone facility houses an essential network hub in a basement, it leaves the current case's need to zone the building with progressively restricted physical access boundaries unresolved.
Question 146 A proposed backup site shares the same floodplain and power substation as the main site. What is the architectural problem? Evaluate fire, thermal and environmental exposure before approving the facility layout Zone the building with progressively restricted physical access boundaries Separate workload identities and restrict service-to-service and orchestration permissions Select recovery locations with genuinely independent regional and utility failure risks Explanation Correct Answer D:Geographical proximity or common utilities can defeat intended recovery independence. Incorrect Answers A:Physical environment can defeat logical controls and destroy irreplaceable records; although this helps when a records vault will sit next to a high-heat manufacturing process, it leaves the current case's need to select recovery locations with genuinely independent regional and utility failure risks unresolved. B:For the separate situation in which an operations room's security perimeter ends at the front door, but visitor access reaches server aisles, facility design should isolate sensitive areas beyond a single outer entrance; here the stated problem requires select recovery locations with genuinely independent regional and utility failure risks. C:This option fits a different fact pattern where a microservices platform shares one cluster-wide administrator identity across every pod: a shared privileged identity turns a single container compromise into broad lateral access; the current case instead requires select recovery locations with genuinely independent regional and utility failure risks.
Question 147 A server room has badge readers but no alarms for a forced door. What should the physical control design add? Assess fire detection and suppression options against occupancy and equipment hazards Combine access control with intrusion detection and monitored response Provide monitored cooling resilience sized for critical heat loads and failure scenarios Align UPS runtime, generator startup and load-transfer capacity to the power gap Explanation Correct Answer B:Preventive door controls require timely detection of forced-entry bypasses. Incorrect Answers A:The other scenario states that a fire-control proposal uses water suppression without evaluating energized equipment and people, where suppression choices must consider safety, local codes and damage to critical systems; by contrast, the present case requires combine access control with intrusion detection and monitored response. C:Power availability alone cannot keep hardware safe without adequate environmental control; this responds to the different circumstance in which a data room's HVAC has no redundancy despite overheating alarms and continuous processing demands, while the current case states that a server room has badge readers but no alarms for a forced door, calling for combine access control with intrusion detection and monitored response. D:This option fits a different fact pattern where a data center's UPS covers five minutes but generators need fifteen minutes to stabilize: resilience fails when transition time exceeds available stored power; the current case instead requires combine access control with intrusion detection and monitored response.
Question 148 A data center's UPS covers five minutes but generators need fifteen minutes to stabilize. What should engineers correct? Assess fire detection and suppression options against occupancy and equipment hazards Provide monitored cooling resilience sized for critical heat loads and failure scenarios Align UPS runtime, generator startup and load-transfer capacity to the power gap Use locked evidence storage with access logs, custody documentation and restricted retrieval Explanation Correct Answer C:Resilience fails when transition time exceeds available stored power. Incorrect Answers A:Suppression choices must consider safety, local codes and damage to critical systems; it is relevant where a fire-control proposal uses water suppression without evaluating energized equipment and people, whereas the current facts require align UPS runtime, generator startup and load-transfer capacity to the power gap to address the stated problem. B:Power availability alone cannot keep hardware safe without adequate environmental control; it is relevant where a data room's HVAC has no redundancy despite overheating alarms and continuous processing demands, whereas the current facts require align UPS runtime, generator startup and load-transfer capacity to the power gap to address the stated problem. D:Physical evidence custody requires accountability for each movement and handler; this responds to the different circumstance in which a secure cabinet permits technicians to remove evidence drives without logging, while the current case states that a data center's UPS covers five minutes but generators need fifteen minutes to stabilize, calling for align UPS runtime, generator startup and load-transfer capacity to the power gap.
Question 149 A fire-control proposal uses water suppression without evaluating energized equipment and people. What is needed? Align UPS runtime, generator startup and load-transfer capacity to the power gap Use locked evidence storage with access logs, custody documentation and restricted retrieval Assess fire detection and suppression options against occupancy and equipment hazards Combine access control with intrusion detection and monitored response Explanation Correct Answer C:Suppression choices must consider safety, local codes and damage to critical systems. Incorrect Answers A:For the separate situation in which a data center's UPS covers five minutes but generators need fifteen minutes to stabilize, resilience fails when transition time exceeds available stored power; here the stated problem requires assess fire detection and suppression options against occupancy and equipment hazards. B:The other scenario states that a secure cabinet permits technicians to remove evidence drives without logging, where physical evidence custody requires accountability for each movement and handler; by contrast, the present case requires assess fire detection and suppression options against occupancy and equipment hazards. D:The other scenario states that a server room has badge readers but no alarms for a forced door, where preventive door controls require timely detection of forced-entry bypasses; by contrast, the present case requires assess fire detection and suppression options against occupancy and equipment hazards.
Question 150 A secure cabinet permits technicians to remove evidence drives without logging. Which safeguard should be strengthened? Align UPS runtime, generator startup and load-transfer capacity to the power gap Provide monitored cooling resilience sized for critical heat loads and failure scenarios Combine access control with intrusion detection and monitored response Use locked evidence storage with access logs, custody documentation and restricted retrieval Explanation Correct Answer D:Physical evidence custody requires accountability for each movement and handler. Incorrect Answers A:Resilience fails when transition time exceeds available stored power; it is relevant where a data center's UPS covers five minutes but generators need fifteen minutes to stabilize, whereas the current facts require use locked evidence storage with access logs, custody documentation and restricted retrieval to address the stated problem. B:This option fits a different fact pattern where a data room's HVAC has no redundancy despite overheating alarms and continuous processing demands: power availability alone cannot keep hardware safe without adequate environmental control; the current case instead requires use locked evidence storage with access logs, custody documentation and restricted retrieval. C:This option fits a different fact pattern where a server room has badge readers but no alarms for a forced door: preventive door controls require timely detection of forced-entry bypasses; the current case instead requires use locked evidence storage with access logs, custody documentation and restricted retrieval.
