Question 190 The company replaces core switches but fails to inventory embedded admin certificates. What commissioning control is required? Separate guest WLAN access and enforce distinct authentication and traffic policies Validate and rotate device identity credentials while onboarding new infrastructure Assign restricted service identities and segment controller access to necessary protocols Use encrypted administrative protocols and restrict their sources and privileges Explanation Correct Answer B:Trust credentials can survive hardware turnover and create unauthorized management paths. Incorrect Answers A:This option fits a different fact pattern where new access points broadcast employee SSIDs without isolating insecure guest clients: an SSID name alone does not create effective trust-zone separation; the current case instead requires validate and rotate device identity credentials while onboarding new infrastructure. C:This option fits a different fact pattern where a Wi-Fi controller can reach production authentication databases using broad admin credentials: compromise of a network appliance should not grant unrestricted backend access; the current case instead requires validate and rotate device identity credentials while onboarding new infrastructure. D:This option fits a different fact pattern where a router is configured directly over Telnet from the public network: telnet exposes management credentials and provides no protected administrative channel; the current case instead requires validate and rotate device identity credentials while onboarding new infrastructure.
Question 191 An organization runs a single monitoring collector on a switch that frequently reboots. What should monitoring design do? Provide resilient logging and telemetry collection independent of any one device Add enclosure locks, monitoring and controlled maintenance access Use encrypted administrative protocols and restrict their sources and privileges Plan supported replacement and use constrained access as temporary risk mitigation Explanation Correct Answer A:Loss of one forwarding device should not erase evidence about a broader incident. Incorrect Answers B:The other scenario states that a remote network cabinet is unlocked and exposed to unescorted visitors, where physical access to switch ports can bypass logical network entry policies; by contrast, the present case requires provide resilient logging and telemetry collection independent of any one device. C:This option fits a different fact pattern where a router is configured directly over Telnet from the public network: telnet exposes management credentials and provides no protected administrative channel; the current case instead requires provide resilient logging and telemetry collection independent of any one device. D:End-of-support infrastructure retains vulnerabilities that ordinary ACLs cannot eliminate; it is relevant where a company uses unsupported routers whose firmware cannot be patched, whereas the current facts require provide resilient logging and telemetry collection independent of any one device to address the stated problem.
Question 192 A router is configured directly over Telnet from the public network. What hardening change is necessary? Use encrypted administrative protocols and restrict their sources and privileges Protect cable routes and access points and monitor for unauthorized handling Add enclosure locks, monitoring and controlled maintenance access Deploy network access control with authenticated device or user posture decisions Explanation Correct Answer A:Telnet exposes management credentials and provides no protected administrative channel. Incorrect Answers B:For the separate situation in which a facility's fiber links pass through an unmonitored public maintenance corridor, physical interception or damage of transmission media can bypass logical policies; here the stated problem requires use encrypted administrative protocols and restrict their sources and privileges. C:Physical access to switch ports can bypass logical network entry policies; although this helps when a remote network cabinet is unlocked and exposed to unescorted visitors, it leaves the current case's need to use encrypted administrative protocols and restrict their sources and privileges unresolved. D:NAC evaluates eligibility before granting appropriate network access; although this helps when an office allows unknown laptops to join a sensitive wired network, it leaves the current case's need to use encrypted administrative protocols and restrict their sources and privileges unresolved.
Question 193 Endpoint certificates are valid but devices are not checked against revocation status during admission. What should NAC enforce? Eliminate the shared power failure dependency and test redundant supply paths Validate certificate trust and revocation within the approved device-admission policy Separate guest WLAN access and enforce distinct authentication and traffic policies Use encrypted administrative protocols and restrict their sources and privileges Explanation Correct Answer B:A once-issued certificate is not conclusive evidence of continuing authorization. Incorrect Answers A:For the separate situation in which a server farm's network fabric has two supervisors but one shared power feed, component redundancy is ineffective if both components fail under the same utility event; here the stated problem requires validate certificate trust and revocation within the approved device-admission policy. C:This option fits a different fact pattern where new access points broadcast employee SSIDs without isolating insecure guest clients: an SSID name alone does not create effective trust-zone separation; the current case instead requires validate certificate trust and revocation within the approved device-admission policy. D:Telnet exposes management credentials and provides no protected administrative channel; it is relevant where a router is configured directly over Telnet from the public network, whereas the current facts require validate certificate trust and revocation within the approved device-admission policy to address the stated problem.
Question 194 A Wi-Fi controller can reach production authentication databases using broad admin credentials. What should be reduced? Validate and rotate device identity credentials while onboarding new infrastructure Replace default access and apply a reviewed device-hardening baseline before connection Assign restricted service identities and segment controller access to necessary protocols Separate guest WLAN access and enforce distinct authentication and traffic policies Explanation Correct Answer C:Compromise of a network appliance should not grant unrestricted backend access. Incorrect Answers A:Trust credentials can survive hardware turnover and create unauthorized management paths; although this helps when the company replaces core switches but fails to inventory embedded admin certificates, it leaves the current case's need to assign restricted service identities and segment controller access to necessary protocols unresolved. B:Factory defaults are a known attack entry point even on trusted internal networks; this responds to the different circumstance in which an enterprise switch is installed with vendor default administrator credentials, while the current case states that a Wi-Fi controller can reach production authentication databases using broad admin credentials, calling for assign restricted service identities and segment controller access to necessary protocols. D:The other scenario states that new access points broadcast employee SSIDs without isolating insecure guest clients, where an SSID name alone does not create effective trust-zone separation; by contrast, the present case requires assign restricted service identities and segment controller access to necessary protocols.
Question 195 A remote network cabinet is unlocked and exposed to unescorted visitors. What protection is appropriate? Eliminate the shared power failure dependency and test redundant supply paths Add enclosure locks, monitoring and controlled maintenance access Validate and rotate device identity credentials while onboarding new infrastructure Provide resilient logging and telemetry collection independent of any one device Explanation Correct Answer B:Physical access to switch ports can bypass logical network entry policies. Incorrect Answers A:Component redundancy is ineffective if both components fail under the same utility event; although this helps when a server farm's network fabric has two supervisors but one shared power feed, it leaves the current case's need to add enclosure locks, monitoring and controlled maintenance access unresolved. C:Trust credentials can survive hardware turnover and create unauthorized management paths; this responds to the different circumstance in which the company replaces core switches but fails to inventory embedded admin certificates, while the current case states that a remote network cabinet is unlocked and exposed to unescorted visitors, calling for add enclosure locks, monitoring and controlled maintenance access. D:The other scenario states that an organization runs a single monitoring collector on a switch that frequently reboots, where loss of one forwarding device should not erase evidence about a broader incident; by contrast, the present case requires add enclosure locks, monitoring and controlled maintenance access.
Question 196 A helpdesk vendor requests permanent full-tunnel VPN access to internal systems although it supports one application. What is preferable? Broker vendor sessions through a managed privileged access gateway with approval and logging Revoke affected tokens and enforce device risk checks at remote access Require recipient authorization and controlled encrypted distribution of recordings Grant time-bound app-specific remote access with strong authentication and session logging Explanation Correct Answer D:Partner need does not justify lasting network-wide reachability. Incorrect Answers A:Brokered access avoids unrestricted inbound tunnels and supports traceability; although this helps when an industrial site wants secure remote maintenance with recording and operator approval, it leaves the current case's need to grant time-bound app-specific remote access with strong authentication and session logging unresolved. B:A valid earlier session may survive password changes unless explicitly invalidated; it is relevant where a remote employee uses the same active session after laptop theft is reported, whereas the current facts require grant time-bound app-specific remote access with strong authentication and session logging to address the stated problem. C:For the separate situation in which a company uses email for confidential board recordings without verifying recipients, an encrypted message delivered to the wrong party is still a disclosure; here the stated problem requires grant time-bound app-specific remote access with strong authentication and session logging.
Question 197 Executives use unmanaged home routers to connect to a sensitive conference system. What should a communication-channel policy require? Require mutually authenticated channel endpoints and documented trust establishment Confirm physical route diversity and test alternate communication paths Protect collaboration access with approved devices, authentication and encrypted sessions Require authenticated invitations, meeting controls and limited recording distribution Explanation Correct Answer C:Encryption alone cannot establish an endpoint is approved and managed. Incorrect Answers A:For the separate situation in which a carrier offers encrypted traffic but cannot attest endpoint identity for intercompany data exchange, confidentiality without peer authentication can be vulnerable to impersonation; here the stated problem requires protect collaboration access with approved devices, authentication and encrypted sessions. B:This option fits a different fact pattern where two sites need failover for a sensitive line, but their 'redundant' circuits share the same underground conduit: two contracts do not eliminate a single shared physical failure domain; the current case instead requires protect collaboration access with approved devices, authentication and encrypted sessions. D:The other scenario states that a video conference contains regulated research data and exposes public join links, where public join URLs undermine participant authorization for confidential collaboration; by contrast, the present case requires protect collaboration access with approved devices, authentication and encrypted sessions.
Question 198 An administrator's SSH keys are shared across a whole operations team. What change improves accountability? Review routing locality, encryption and contractual data-residency requirements Require authenticated invitations, meeting controls and limited recording distribution Set connectivity service-level objectives and independent link-health alerting Issue individual controlled keys or certificates with auditable privileged sessions Explanation Correct Answer D:Shared administrative credentials obscure attribution and complicate revocation. Incorrect Answers A:Outsourced communications can cross jurisdictions and trust boundaries; it is relevant where a WAN provider handles backup replication and carries traffic through unknown regions, whereas the current facts require issue individual controlled keys or certificates with auditable privileged sessions to address the stated problem. B:This option fits a different fact pattern where a video conference contains regulated research data and exposes public join links: public join URLs undermine participant authorization for confidential collaboration; the current case instead requires issue individual controlled keys or certificates with auditable privileged sessions. C:Third-party channels require measurable operational assurance, not merely connectivity at installation; this responds to the different circumstance in which a third-party data link is contractually critical but has no outage notification or route monitoring, while the current case states that an administrator's SSH keys are shared across a whole operations team, calling for issue individual controlled keys or certificates with auditable privileged sessions.
Question 199 A carrier offers encrypted traffic but cannot attest endpoint identity for intercompany data exchange. What is missing? Require mutually authenticated channel endpoints and documented trust establishment Protect collaboration access with approved devices, authentication and encrypted sessions Require recipient authorization and controlled encrypted distribution of recordings Review routing locality, encryption and contractual data-residency requirements Explanation Correct Answer A:Confidentiality without peer authentication can be vulnerable to impersonation. Incorrect Answers B:For the separate situation in which executives use unmanaged home routers to connect to a sensitive conference system, encryption alone cannot establish an endpoint is approved and managed; here the stated problem requires require mutually authenticated channel endpoints and documented trust establishment. C:For the separate situation in which a company uses email for confidential board recordings without verifying recipients, an encrypted message delivered to the wrong party is still a disclosure; here the stated problem requires require mutually authenticated channel endpoints and documented trust establishment. D:Outsourced communications can cross jurisdictions and trust boundaries; it is relevant where a WAN provider handles backup replication and carries traffic through unknown regions, whereas the current facts require require mutually authenticated channel endpoints and documented trust establishment to address the stated problem.
Question 200 A company uses email for confidential board recordings without verifying recipients. What should the workflow include? Require recipient authorization and controlled encrypted distribution of recordings Encrypt every recording but keep sending it to unverified email addresses Upload board recordings to a publicly indexed link instead of sending mail attachments Approve a broad recipient list once and skip verification of recipients for subsequent board sessions Explanation Correct Answer A:An encrypted message delivered to the wrong party is still a disclosure. Incorrect Answers B:Encryption may protect data in transit, but without checking who receives the decryption capability it cannot prevent disclosure to unintended people. C:Changing the delivery medium to an openly accessible link makes confidentiality worse and does not enforce authorized recipients. D:Recipient membership and authorization can change between recordings; the workflow needs a per-distribution control rather than a permanent blanket assumption.
