Question 180 A firewall allows outbound connections to every port from a sensitive data processing enclave. What is the defensible default? Define explicit destination and service allowlists with monitored exceptions Implement equivalent IPv6 routing, filtering and observability policies Collect network flow and dependency evidence to build an accurate application communication map Require authorized network admission and role-appropriate access beyond link encryption Explanation Correct Answer A:Least-privilege egress reduces external command-and-control and unapproved data movement. Incorrect Answers B:Dual-stack deployments introduce separate address and control surfaces that must be governed; this responds to the different circumstance in which a business sends sensitive IPv6 traffic but monitors only IPv4 firewall rules, while the current case states that a firewall allows outbound connections to every port from a sensitive data processing enclave, calling for define explicit destination and service allowlists with monitored exceptions. C:This option fits a different fact pattern where a company wants to identify hidden internal east-west connections before defining segmentation: control design depends on real service dependencies, not assumed VLAN membership; the current case instead requires define explicit destination and service allowlists with monitored exceptions. D:Encryption of radio frames alone does not establish need-to-know for the service network; although this helps when a research lab encrypts Wi-Fi but allows any employee to join a sensitive test network, it leaves the current case's need to define explicit destination and service allowlists with monitored exceptions unresolved.
Question 181 A distributed learning cluster sends private model inputs to public edge nodes without transport authentication. What is needed? Engineer independently routed paths and verify failure detection and convergence Protect controller APIs using least-privilege authorization, strong authentication and audit Mutually authenticate endpoints and encrypt model traffic across network trust boundaries Use dedicated identity and privileged-access controls for administration rather than content delivery Explanation Correct Answer C:Large AI datasets still require authenticated transport and confidentiality on untrusted links. Incorrect Answers A:The other scenario states that an enterprise depends entirely on one network path through a provider edge for critical communications, where a single carrier or edge dependency can defeat internal equipment redundancy; by contrast, the present case requires mutually authenticate endpoints and encrypt model traffic across network trust boundaries. B:A centralized control plane has broad blast radius if management access is compromised; this responds to the different circumstance in which an SDN controller API can change routing across every tenant without strong access control, while the current case states that a distributed learning cluster sends private model inputs to public edge nodes without transport authentication, calling for mutually authenticate endpoints and encrypt model traffic across network trust boundaries. D:For the separate situation in which a developer suggests using a CDN to authenticate private database administrators, a CDN optimizes distribution but does not replace administrative authentication and authorization; here the stated problem requires mutually authenticate endpoints and encrypt model traffic across network trust boundaries.
Question 182 An enterprise depends entirely on one network path through a provider edge for critical communications. What architecture issue should be mitigated? Create industrial security zones and tightly governed conduits between corporate and OT networks Require supported TLS versions and validated certificate-based server authentication Mutually authenticate endpoints and encrypt model traffic across network trust boundaries Engineer independently routed paths and verify failure detection and convergence Explanation Correct Answer D:A single carrier or edge dependency can defeat internal equipment redundancy. Incorrect Answers A:Explicit segmentation constrains malware spread and protects safety-critical control traffic; this responds to the different circumstance in which a manufacturing plant permits unrestricted traffic from office laptops to programmable controllers, while the current case states that an enterprise depends entirely on one network path through a provider edge for critical communications, calling for engineer independently routed paths and verify failure detection and convergence. B:Secure transport depends on current protocol configuration and identity validation; although this helps when a public API uses obsolete SSL negotiation even though clients support modern TLS, it leaves the current case's need to engineer independently routed paths and verify failure detection and convergence unresolved. C:Large AI datasets still require authenticated transport and confidentiality on untrusted links; although this helps when a distributed learning cluster sends private model inputs to public edge nodes without transport authentication, it leaves the current case's need to engineer independently routed paths and verify failure detection and convergence unresolved.
Question 183 An enterprise switch is installed with vendor default administrator credentials. What should secure commissioning require? Provide resilient logging and telemetry collection independent of any one device Use encrypted administrative protocols and restrict their sources and privileges Replace default access and apply a reviewed device-hardening baseline before connection Assign restricted service identities and segment controller access to necessary protocols Explanation Correct Answer C:Factory defaults are a known attack entry point even on trusted internal networks. Incorrect Answers A:The other scenario states that an organization runs a single monitoring collector on a switch that frequently reboots, where loss of one forwarding device should not erase evidence about a broader incident; by contrast, the present case requires replace default access and apply a reviewed device-hardening baseline before connection. B:Telnet exposes management credentials and provides no protected administrative channel; it is relevant where a router is configured directly over Telnet from the public network, whereas the current facts require replace default access and apply a reviewed device-hardening baseline before connection to address the stated problem. D:Compromise of a network appliance should not grant unrestricted backend access; it is relevant where a Wi-Fi controller can reach production authentication databases using broad admin credentials, whereas the current facts require replace default access and apply a reviewed device-hardening baseline before connection to address the stated problem.
Question 184 A company uses unsupported routers whose firmware cannot be patched. What is a sound network-component response? Eliminate the shared power failure dependency and test redundant supply paths Harden and monitor network appliances as managed endpoints with supported update processes Plan supported replacement and use constrained access as temporary risk mitigation Use encrypted administrative protocols and restrict their sources and privileges Explanation Correct Answer C:End-of-support infrastructure retains vulnerabilities that ordinary ACLs cannot eliminate. Incorrect Answers A:Component redundancy is ineffective if both components fail under the same utility event; although this helps when a server farm's network fabric has two supervisors but one shared power feed, it leaves the current case's need to plan supported replacement and use constrained access as temporary risk mitigation unresolved. B:Network devices are attackable computing assets, not inherently protected transit devices; although this helps when a security team applies endpoint EDR but ignores a vulnerable appliance control interface, it leaves the current case's need to plan supported replacement and use constrained access as temporary risk mitigation unresolved. D:For the separate situation in which a router is configured directly over Telnet from the public network, telnet exposes management credentials and provides no protected administrative channel; here the stated problem requires plan supported replacement and use constrained access as temporary risk mitigation.
Question 185 An office allows unknown laptops to join a sensitive wired network. Which control helps enforce admission policy? Eliminate the shared power failure dependency and test redundant supply paths Deploy network access control with authenticated device or user posture decisions Validate and rotate device identity credentials while onboarding new infrastructure Harden and monitor network appliances as managed endpoints with supported update processes Explanation Correct Answer B:NAC evaluates eligibility before granting appropriate network access. Incorrect Answers A:Component redundancy is ineffective if both components fail under the same utility event; this responds to the different circumstance in which a server farm's network fabric has two supervisors but one shared power feed, while the current case states that an office allows unknown laptops to join a sensitive wired network, calling for deploy network access control with authenticated device or user posture decisions. C:Trust credentials can survive hardware turnover and create unauthorized management paths; it is relevant where the company replaces core switches but fails to inventory embedded admin certificates, whereas the current facts require deploy network access control with authenticated device or user posture decisions to address the stated problem. D:Network devices are attackable computing assets, not inherently protected transit devices; it is relevant where a security team applies endpoint EDR but ignores a vulnerable appliance control interface, whereas the current facts require deploy network access control with authenticated device or user posture decisions to address the stated problem.
Question 186 A server farm's network fabric has two supervisors but one shared power feed. What should be improved? Provide resilient logging and telemetry collection independent of any one device Eliminate the shared power failure dependency and test redundant supply paths Harden and monitor network appliances as managed endpoints with supported update processes Plan supported replacement and use constrained access as temporary risk mitigation Explanation Correct Answer B:Component redundancy is ineffective if both components fail under the same utility event. Incorrect Answers A:Loss of one forwarding device should not erase evidence about a broader incident; this responds to the different circumstance in which an organization runs a single monitoring collector on a switch that frequently reboots, while the current case states that a server farm's network fabric has two supervisors but one shared power feed, calling for eliminate the shared power failure dependency and test redundant supply paths. C:Network devices are attackable computing assets, not inherently protected transit devices; it is relevant where a security team applies endpoint EDR but ignores a vulnerable appliance control interface, whereas the current facts require eliminate the shared power failure dependency and test redundant supply paths to address the stated problem. D:End-of-support infrastructure retains vulnerabilities that ordinary ACLs cannot eliminate; this responds to the different circumstance in which a company uses unsupported routers whose firmware cannot be patched, while the current case states that a server farm's network fabric has two supervisors but one shared power feed, calling for eliminate the shared power failure dependency and test redundant supply paths.
Question 187 A facility's fiber links pass through an unmonitored public maintenance corridor. What physical protection is needed? Validate and rotate device identity credentials while onboarding new infrastructure Protect cable routes and access points and monitor for unauthorized handling Use encrypted administrative protocols and restrict their sources and privileges Add enclosure locks, monitoring and controlled maintenance access Explanation Correct Answer B:Physical interception or damage of transmission media can bypass logical policies. Incorrect Answers A:The other scenario states that the company replaces core switches but fails to inventory embedded admin certificates, where trust credentials can survive hardware turnover and create unauthorized management paths; by contrast, the present case requires protect cable routes and access points and monitor for unauthorized handling. C:Telnet exposes management credentials and provides no protected administrative channel; it is relevant where a router is configured directly over Telnet from the public network, whereas the current facts require protect cable routes and access points and monitor for unauthorized handling to address the stated problem. D:Physical access to switch ports can bypass logical network entry policies; it is relevant where a remote network cabinet is unlocked and exposed to unescorted visitors, whereas the current facts require protect cable routes and access points and monitor for unauthorized handling to address the stated problem.
Question 188 A security team applies endpoint EDR but ignores a vulnerable appliance control interface. What should its asset controls include? Harden and monitor network appliances as managed endpoints with supported update processes Separate guest WLAN access and enforce distinct authentication and traffic policies Eliminate the shared power failure dependency and test redundant supply paths Plan supported replacement and use constrained access as temporary risk mitigation Explanation Correct Answer A:Network devices are attackable computing assets, not inherently protected transit devices. Incorrect Answers B:An SSID name alone does not create effective trust-zone separation; this responds to the different circumstance in which new access points broadcast employee SSIDs without isolating insecure guest clients, while the current case states that a security team applies endpoint EDR but ignores a vulnerable appliance control interface, calling for harden and monitor network appliances as managed endpoints with supported update processes. C:For the separate situation in which a server farm's network fabric has two supervisors but one shared power feed, component redundancy is ineffective if both components fail under the same utility event; here the stated problem requires harden and monitor network appliances as managed endpoints with supported update processes. D:End-of-support infrastructure retains vulnerabilities that ordinary ACLs cannot eliminate; although this helps when a company uses unsupported routers whose firmware cannot be patched, it leaves the current case's need to harden and monitor network appliances as managed endpoints with supported update processes unresolved.
Question 189 New access points broadcast employee SSIDs without isolating insecure guest clients. What should WLAN planning implement? Provide resilient logging and telemetry collection independent of any one device Separate guest WLAN access and enforce distinct authentication and traffic policies Eliminate the shared power failure dependency and test redundant supply paths Deploy network access control with authenticated device or user posture decisions Explanation Correct Answer B:An SSID name alone does not create effective trust-zone separation. Incorrect Answers A:Loss of one forwarding device should not erase evidence about a broader incident; this responds to the different circumstance in which an organization runs a single monitoring collector on a switch that frequently reboots, while the current case states that new access points broadcast employee SSIDs without isolating insecure guest clients, calling for separate guest WLAN access and enforce distinct authentication and traffic policies. C:The other scenario states that a server farm's network fabric has two supervisors but one shared power feed, where component redundancy is ineffective if both components fail under the same utility event; by contrast, the present case requires separate guest WLAN access and enforce distinct authentication and traffic policies. D:NAC evaluates eligibility before granting appropriate network access; this responds to the different circumstance in which an office allows unknown laptops to join a sensitive wired network, while the current case states that new access points broadcast employee SSIDs without isolating insecure guest clients, calling for separate guest WLAN access and enforce distinct authentication and traffic policies.
Question 190 The company replaces core switches but fails to inventory embedded admin certificates. What commissioning control is required? Separate guest WLAN access and enforce distinct authentication and traffic policies Validate and rotate device identity credentials while onboarding new infrastructure Assign restricted service identities and segment controller access to necessary protocols Use encrypted administrative protocols and restrict their sources and privileges Explanation Correct Answer B:Trust credentials can survive hardware turnover and create unauthorized management paths. Incorrect Answers A:This option fits a different fact pattern where new access points broadcast employee SSIDs without isolating insecure guest clients: an SSID name alone does not create effective trust-zone separation; the current case instead requires validate and rotate device identity credentials while onboarding new infrastructure. C:This option fits a different fact pattern where a Wi-Fi controller can reach production authentication databases using broad admin credentials: compromise of a network appliance should not grant unrestricted backend access; the current case instead requires validate and rotate device identity credentials while onboarding new infrastructure. D:This option fits a different fact pattern where a router is configured directly over Telnet from the public network: telnet exposes management credentials and provides no protected administrative channel; the current case instead requires validate and rotate device identity credentials while onboarding new infrastructure.
