Question 200 A company uses email for confidential board recordings without verifying recipients. What should the workflow include? Require recipient authorization and controlled encrypted distribution of recordings Encrypt every recording but keep sending it to unverified email addresses Upload board recordings to a publicly indexed link instead of sending mail attachments Approve a broad recipient list once and skip verification of recipients for subsequent board sessions Explanation Correct Answer A:An encrypted message delivered to the wrong party is still a disclosure. Incorrect Answers B:Encryption may protect data in transit, but without checking who receives the decryption capability it cannot prevent disclosure to unintended people. C:Changing the delivery medium to an openly accessible link makes confidentiality worse and does not enforce authorized recipients. D:Recipient membership and authorization can change between recordings; the workflow needs a per-distribution control rather than a permanent blanket assumption.
Question 201 A third-party data link is contractually critical but has no outage notification or route monitoring. What controls are appropriate? Set connectivity service-level objectives and independent link-health alerting Require mutually authenticated channel endpoints and documented trust establishment Require authenticated invitations, meeting controls and limited recording distribution Implement controlled, monitored, time-limited access with explicit emergency authorization Explanation Correct Answer A:Third-party channels require measurable operational assurance, not merely connectivity at installation. Incorrect Answers B:Confidentiality without peer authentication can be vulnerable to impersonation; this responds to the different circumstance in which a carrier offers encrypted traffic but cannot attest endpoint identity for intercompany data exchange, while the current case states that a third-party data link is contractually critical but has no outage notification or route monitoring, calling for set connectivity service-level objectives and independent link-health alerting. C:Public join URLs undermine participant authorization for confidential collaboration; this responds to the different circumstance in which a video conference contains regulated research data and exposes public join links, while the current case states that a third-party data link is contractually critical but has no outage notification or route monitoring, calling for set connectivity service-level objectives and independent link-health alerting. D:Persistent unmanaged remote ingress has excessive exposure and poor accountability; it is relevant where a third-party support engineer demands unattended modem dial-in to emergency systems, whereas the current facts require set connectivity service-level objectives and independent link-health alerting to address the stated problem.
Question 202 An industrial site wants secure remote maintenance with recording and operator approval. What architecture should it use? Require authenticated invitations, meeting controls and limited recording distribution Broker vendor sessions through a managed privileged access gateway with approval and logging Use current authenticated transport configurations and phase out unsupported cryptography Set connectivity service-level objectives and independent link-health alerting Explanation Correct Answer B:Brokered access avoids unrestricted inbound tunnels and supports traceability. Incorrect Answers A:Public join URLs undermine participant authorization for confidential collaboration; this responds to the different circumstance in which a video conference contains regulated research data and exposes public join links, while the current case states that an industrial site wants secure remote maintenance with recording and operator approval, calling for broker vendor sessions through a managed privileged access gateway with approval and logging. C:Permitting obsolete negotiation weakens the effective security of an otherwise encrypted channel; this responds to the different circumstance in which an internal mobile app allows only weak legacy cipher suites on remote connection, while the current case states that an industrial site wants secure remote maintenance with recording and operator approval, calling for broker vendor sessions through a managed privileged access gateway with approval and logging. D:This option fits a different fact pattern where a third-party data link is contractually critical but has no outage notification or route monitoring: third-party channels require measurable operational assurance, not merely connectivity at installation; the current case instead requires broker vendor sessions through a managed privileged access gateway with approval and logging.
Question 203 A remote employee uses the same active session after laptop theft is reported. What session protection is appropriate? Review routing locality, encryption and contractual data-residency requirements Require recipient authorization and controlled encrypted distribution of recordings Revoke affected tokens and enforce device risk checks at remote access Issue individual controlled keys or certificates with auditable privileged sessions Explanation Correct Answer C:A valid earlier session may survive password changes unless explicitly invalidated. Incorrect Answers A:Outsourced communications can cross jurisdictions and trust boundaries; although this helps when a WAN provider handles backup replication and carries traffic through unknown regions, it leaves the current case's need to revoke affected tokens and enforce device risk checks at remote access unresolved. B:This option fits a different fact pattern where a company uses email for confidential board recordings without verifying recipients: an encrypted message delivered to the wrong party is still a disclosure; the current case instead requires revoke affected tokens and enforce device risk checks at remote access. D:The other scenario states that an administrator's SSH keys are shared across a whole operations team, where shared administrative credentials obscure attribution and complicate revocation; by contrast, the present case requires revoke affected tokens and enforce device risk checks at remote access.
Question 204 A video conference contains regulated research data and exposes public join links. What should be changed? Require mutually authenticated channel endpoints and documented trust establishment Protect collaboration access with approved devices, authentication and encrypted sessions Require authenticated invitations, meeting controls and limited recording distribution Broker vendor sessions through a managed privileged access gateway with approval and logging Explanation Correct Answer C:Public join URLs undermine participant authorization for confidential collaboration. Incorrect Answers A:Confidentiality without peer authentication can be vulnerable to impersonation; although this helps when a carrier offers encrypted traffic but cannot attest endpoint identity for intercompany data exchange, it leaves the current case's need to require authenticated invitations, meeting controls and limited recording distribution unresolved. B:The other scenario states that executives use unmanaged home routers to connect to a sensitive conference system, where encryption alone cannot establish an endpoint is approved and managed; by contrast, the present case requires require authenticated invitations, meeting controls and limited recording distribution. D:The other scenario states that an industrial site wants secure remote maintenance with recording and operator approval, where brokered access avoids unrestricted inbound tunnels and supports traceability; by contrast, the present case requires require authenticated invitations, meeting controls and limited recording distribution.
Question 205 A WAN provider handles backup replication and carries traffic through unknown regions. What due diligence is needed? Require mutually authenticated channel endpoints and documented trust establishment Review routing locality, encryption and contractual data-residency requirements Require recipient authorization and controlled encrypted distribution of recordings Use current authenticated transport configurations and phase out unsupported cryptography Explanation Correct Answer B:Outsourced communications can cross jurisdictions and trust boundaries. Incorrect Answers A:The other scenario states that a carrier offers encrypted traffic but cannot attest endpoint identity for intercompany data exchange, where confidentiality without peer authentication can be vulnerable to impersonation; by contrast, the present case requires review routing locality, encryption and contractual data-residency requirements. C:An encrypted message delivered to the wrong party is still a disclosure; it is relevant where a company uses email for confidential board recordings without verifying recipients, whereas the current facts require review routing locality, encryption and contractual data-residency requirements to address the stated problem. D:This option fits a different fact pattern where an internal mobile app allows only weak legacy cipher suites on remote connection: permitting obsolete negotiation weakens the effective security of an otherwise encrypted channel; the current case instead requires review routing locality, encryption and contractual data-residency requirements.
Question 206 An internal mobile app allows only weak legacy cipher suites on remote connection. What should developers change? Issue individual controlled keys or certificates with auditable privileged sessions Broker vendor sessions through a managed privileged access gateway with approval and logging Use current authenticated transport configurations and phase out unsupported cryptography Grant time-bound app-specific remote access with strong authentication and session logging Explanation Correct Answer C:Permitting obsolete negotiation weakens the effective security of an otherwise encrypted channel. Incorrect Answers A:Shared administrative credentials obscure attribution and complicate revocation; it is relevant where an administrator's SSH keys are shared across a whole operations team, whereas the current facts require use current authenticated transport configurations and phase out unsupported cryptography to address the stated problem. B:Brokered access avoids unrestricted inbound tunnels and supports traceability; although this helps when an industrial site wants secure remote maintenance with recording and operator approval, it leaves the current case's need to use current authenticated transport configurations and phase out unsupported cryptography unresolved. D:Partner need does not justify lasting network-wide reachability; it is relevant where a helpdesk vendor requests permanent full-tunnel VPN access to internal systems although it supports one application, whereas the current facts require use current authenticated transport configurations and phase out unsupported cryptography to address the stated problem.
Question 207 A third-party support engineer demands unattended modem dial-in to emergency systems. What should security require? Use current authenticated transport configurations and phase out unsupported cryptography Confirm physical route diversity and test alternate communication paths Implement controlled, monitored, time-limited access with explicit emergency authorization Set connectivity service-level objectives and independent link-health alerting Explanation Correct Answer C:Persistent unmanaged remote ingress has excessive exposure and poor accountability. Incorrect Answers A:The other scenario states that an internal mobile app allows only weak legacy cipher suites on remote connection, where permitting obsolete negotiation weakens the effective security of an otherwise encrypted channel; by contrast, the present case requires implement controlled, monitored, time-limited access with explicit emergency authorization. B:Two contracts do not eliminate a single shared physical failure domain; although this helps when two sites need failover for a sensitive line, but their 'redundant' circuits share the same underground conduit, it leaves the current case's need to implement controlled, monitored, time-limited access with explicit emergency authorization unresolved. D:Third-party channels require measurable operational assurance, not merely connectivity at installation; it is relevant where a third-party data link is contractually critical but has no outage notification or route monitoring, whereas the current facts require implement controlled, monitored, time-limited access with explicit emergency authorization to address the stated problem.
Question 208 Two sites need failover for a sensitive line, but their 'redundant' circuits share the same underground conduit. What should be assessed? Confirm physical route diversity and test alternate communication paths Set connectivity service-level objectives and independent link-health alerting Require recipient authorization and controlled encrypted distribution of recordings Protect collaboration access with approved devices, authentication and encrypted sessions Explanation Correct Answer A:Two contracts do not eliminate a single shared physical failure domain. Incorrect Answers B:The other scenario states that a third-party data link is contractually critical but has no outage notification or route monitoring, where third-party channels require measurable operational assurance, not merely connectivity at installation; by contrast, the present case requires confirm physical route diversity and test alternate communication paths. C:This option fits a different fact pattern where a company uses email for confidential board recordings without verifying recipients: an encrypted message delivered to the wrong party is still a disclosure; the current case instead requires confirm physical route diversity and test alternate communication paths. D:Encryption alone cannot establish an endpoint is approved and managed; it is relevant where executives use unmanaged home routers to connect to a sensitive conference system, whereas the current facts require confirm physical route diversity and test alternate communication paths to address the stated problem.
Question 209 A facilities engineer needs entry to one equipment room but receives access to the entire campus. What should be revised? Revoke device sessions and enforce managed endpoint authorization before data access Restrict the supplier integration to approved print queues and document scopes Scope physical access to authorized zones and schedules based on job need Constrain the service identity to necessary data objects and operations Explanation Correct Answer C:Badge activation should reflect specific facility duties instead of default building-wide access. Incorrect Answers A:The other scenario states that a mobile device with corporate mail is lost and still has a functioning authentication session, where lost-device containment requires identity and device controls, not only account passwords; by contrast, the present case requires scope physical access to authorized zones and schedules based on job need. B:For the separate situation in which an outsourced printer service can retrieve confidential documents from all departments, vendor service privileges should not imply organization-wide document visibility; here the stated problem requires scope physical access to authorized zones and schedules based on job need. D:Service identities must follow least privilege just like human accounts; it is relevant where a developer's service account can read every production database though it needs only one schema, whereas the current facts require scope physical access to authorized zones and schedules based on job need to address the stated problem.
Question 210 A developer's service account can read every production database though it needs only one schema. Which principle applies? Enforce explicit object-level authorization for model and dataset access Scope physical access to authorized zones and schedules based on job need Use controlled inner barriers and anti-tailgating measures for sensitive zones Constrain the service identity to necessary data objects and operations Explanation Correct Answer D:Service identities must follow least privilege just like human accounts. Incorrect Answers A:Enterprise sign-in does not justify blanket access to intellectual property; it is relevant where an analytics platform grants all employee identities the ability to enumerate sensitive model artifacts, whereas the current facts require constrain the service identity to necessary data objects and operations to address the stated problem. B:The other scenario states that a facilities engineer needs entry to one equipment room but receives access to the entire campus, where badge activation should reflect specific facility duties instead of default building-wide access; by contrast, the present case requires constrain the service identity to necessary data objects and operations. C:For the separate situation in which a visitor is authorized in a reception area but can follow employees into secure rooms, an authorized perimeter visit is not authorization to access restricted rooms; here the stated problem requires constrain the service identity to necessary data objects and operations.
