Question 240 An employee can change both the approval rule and the corresponding payment record. What should authorization design do? Apply attribute-based access control with trustworthy subject, object and environment attributes Implement mandatory access controls with centrally governed security labels Separate administration of authorization policy from high-risk business transactions Use role-based access control with approved role definitions and separation of duties Explanation Correct Answer C:Segregation prevents one principal from self-authorizing sensitive actions. Incorrect Answers A:For the separate situation in which a multinational wants access based on department, project, record sensitivity and region in one decision, aBAC evaluates policy predicates beyond one static role label; here the stated problem requires separate administration of authorization policy from high-risk business transactions. B:This option fits a different fact pattern where a laboratory must restrict a document by both employee clearance and classified label: mAC decisions are driven by system-enforced classifications and clearances; the current case instead requires separate administration of authorization policy from high-risk business transactions. D:The other scenario states that a bank grants privileges by job functions such as teller and approver, where rBAC maps entitlements to business roles rather than to arbitrary individual exceptions; by contrast, the present case requires separate administration of authorization policy from high-risk business transactions.
Question 241 A technician is granted every filesystem permission because a single command requires write access. What should be revised? Implement mandatory access controls with centrally governed security labels Scope actions and resources to the minimum permissions required for the approved task Use role-based access control with approved role definitions and separation of duties Include contextual risk signals in policy decisions while preserving auditable rule governance Explanation Correct Answer B:Least privilege applies at operation and resource granularity, not only account membership. Incorrect Answers A:The other scenario states that a laboratory must restrict a document by both employee clearance and classified label, where mAC decisions are driven by system-enforced classifications and clearances; by contrast, the present case requires scope actions and resources to the minimum permissions required for the approved task. C:RBAC maps entitlements to business roles rather than to arbitrary individual exceptions; this responds to the different circumstance in which a bank grants privileges by job functions such as teller and approver, while the current case states that a technician is granted every filesystem permission because a single command requires write access, calling for scope actions and resources to the minimum permissions required for the approved task. D:Risk-adaptive access may change based on current transaction or actor risk; although this helps when a payment system denies approval when the operator's fraud-risk score exceeds a threshold, it leaves the current case's need to scope actions and resources to the minimum permissions required for the approved task unresolved.
Question 242 A system's nightly batch job requires access only between 02:00 and 03:00. Which access policy is appropriate? Use role-based access control with approved role definitions and separation of duties Enforce time-conditional authorization and disable access outside the approved window Keep policy decision logic separate from a policy enforcement point that actually blocks disallowed actions Use discretionary access decisions by the resource owner within overarching policy Explanation Correct Answer B:Environmental and scheduling constraints can make static 24-hour roles unnecessarily broad. Incorrect Answers A:RBAC maps entitlements to business roles rather than to arbitrary individual exceptions; although this helps when a bank grants privileges by job functions such as teller and approver, it leaves the current case's need to enforce time-conditional authorization and disable access outside the approved window unresolved. C:This option fits a different fact pattern where a network gateway decides whether to permit a request, but the application ignores the decision: a decision point cannot protect resources unless its verdict is consistently enforced; the current case instead requires enforce time-conditional authorization and disable access outside the approved window. D:DAC allows delegated owner-driven permissions, subject to higher-level restrictions; although this helps when a project shares reports with a collaborator only when the resource owner authorizes that person, it leaves the current case's need to enforce time-conditional authorization and disable access outside the approved window unresolved.
Question 243 A policy permits a contractor to view records only in their assigned region but the API never checks region claims. What must be fixed? Enforce verified region and resource attributes at each protected API operation Scope actions and resources to the minimum permissions required for the approved task Include contextual risk signals in policy decisions while preserving auditable rule governance Enforce time-conditional authorization and disable access outside the approved window Explanation Correct Answer A:Policy text has no protective effect unless its conditions are evaluated during access. Incorrect Answers B:Least privilege applies at operation and resource granularity, not only account membership; it is relevant where a technician is granted every filesystem permission because a single command requires write access, whereas the current facts require enforce verified region and resource attributes at each protected API operation to address the stated problem. C:Risk-adaptive access may change based on current transaction or actor risk; although this helps when a payment system denies approval when the operator's fraud-risk score exceeds a threshold, it leaves the current case's need to enforce verified region and resource attributes at each protected API operation unresolved. D:This option fits a different fact pattern where a system's nightly batch job requires access only between 02:00 and 03:00: environmental and scheduling constraints can make static 24-hour roles unnecessarily broad; the current case instead requires enforce verified region and resource attributes at each protected API operation.
Question 244 A user leaves the company but cloud entitlements remain due to delayed HR synchronization. What lifecycle process must be improved? Invalidate or limit existing sessions in addition to preventing new authentication Create distinct least-privilege workload identities with traceable ownership Use timely identity lifecycle triggers and verify deprovisioning across all connected services Conduct mover-triggered and scheduled access recertification with privilege removal Explanation Correct Answer C:Termination should remove effective access, not just disable one directory account. Incorrect Answers A:For the separate situation in which a security team sees successful logins after employee disablement because cached sessions remain valid, account deactivation may not terminate all previously issued credentials or tokens; here the stated problem requires use timely identity lifecycle triggers and verify deprovisioning across all connected services. B:Separation and attribution contain compromise and simplify rotation; it is relevant where a root-level service account is shared across multiple automation jobs, whereas the current facts require use timely identity lifecycle triggers and verify deprovisioning across all connected services to address the stated problem. D:For the separate situation in which an engineer is promoted and accumulates legacy privileges from three previous jobs, privilege accumulation creates excess exposure even when each historical assignment was initially authorized; here the stated problem requires use timely identity lifecycle triggers and verify deprovisioning across all connected services.
Question 245 An engineer is promoted and accumulates legacy privileges from three previous jobs. What control addresses this? Identify the accountable owner and justified use before renewing the entitlement Assign a service-account owner and implement reviewed credential rotation and expiry Conduct mover-triggered and scheduled access recertification with privilege removal Invalidate or limit existing sessions in addition to preventing new authentication Explanation Correct Answer C:Privilege accumulation creates excess exposure even when each historical assignment was initially authorized. Incorrect Answers A:This option fits a different fact pattern where an access review confirms an account is used but nobody knows its business purpose: use frequency is not proof of legitimate business authorization; the current case instead requires conduct mover-triggered and scheduled access recertification with privilege removal. B:Machine identities require lifecycle management and evidence of continued necessity; this responds to the different circumstance in which a noninteractive integration token has no owner and has not rotated for years, while the current case states that an engineer is promoted and accumulates legacy privileges from three previous jobs, calling for conduct mover-triggered and scheduled access recertification with privilege removal. D:Account deactivation may not terminate all previously issued credentials or tokens; this responds to the different circumstance in which a security team sees successful logins after employee disablement because cached sessions remain valid, while the current case states that an engineer is promoted and accumulates legacy privileges from three previous jobs, calling for conduct mover-triggered and scheduled access recertification with privilege removal.
Question 246 A noninteractive integration token has no owner and has not rotated for years. What governance is required? Create distinct least-privilege workload identities with traceable ownership Issue time-limited, recorded break-glass access under a defined emergency workflow Assign a service-account owner and implement reviewed credential rotation and expiry Revoke third-party keys, roles, tokens and dependent integrations at contract termination Explanation Correct Answer C:Machine identities require lifecycle management and evidence of continued necessity. Incorrect Answers A:For the separate situation in which a root-level service account is shared across multiple automation jobs, separation and attribution contain compromise and simplify rotation; here the stated problem requires assign a service-account owner and implement reviewed credential rotation and expiry. B:Emergency access should be narrow, auditable and revoked after the incident; it is relevant where an employee requests database admin rights outside approved roles for an emergency, whereas the current facts require assign a service-account owner and implement reviewed credential rotation and expiry to address the stated problem. D:Ending a contractual relationship alone does not disable technical access; although this helps when a vendor is removed from a contract but retained API keys still work, it leaves the current case's need to assign a service-account owner and implement reviewed credential rotation and expiry unresolved.
Question 247 A manager approves a role without checking incompatible finance duties. What should provisioning enforce? Invalidate or limit existing sessions in addition to preventing new authentication Assign a service-account owner and implement reviewed credential rotation and expiry Create distinct least-privilege workload identities with traceable ownership Check segregation-of-duties conflicts before entitlement activation Explanation Correct Answer D:Provisioning should detect toxic combinations before they create an unauthorized workflow. Incorrect Answers A:Account deactivation may not terminate all previously issued credentials or tokens; it is relevant where a security team sees successful logins after employee disablement because cached sessions remain valid, whereas the current facts require check segregation-of-duties conflicts before entitlement activation to address the stated problem. B:Machine identities require lifecycle management and evidence of continued necessity; it is relevant where a noninteractive integration token has no owner and has not rotated for years, whereas the current facts require check segregation-of-duties conflicts before entitlement activation to address the stated problem. C:Separation and attribution contain compromise and simplify rotation; although this helps when a root-level service account is shared across multiple automation jobs, it leaves the current case's need to check segregation-of-duties conflicts before entitlement activation unresolved.
Question 248 An employee requests database admin rights outside approved roles for an emergency. What process is most appropriate? Identify the accountable owner and justified use before renewing the entitlement Issue time-limited, recorded break-glass access under a defined emergency workflow Use timely identity lifecycle triggers and verify deprovisioning across all connected services Revoke third-party keys, roles, tokens and dependent integrations at contract termination Explanation Correct Answer B:Emergency access should be narrow, auditable and revoked after the incident. Incorrect Answers A:Use frequency is not proof of legitimate business authorization; it is relevant where an access review confirms an account is used but nobody knows its business purpose, whereas the current facts require issue time-limited, recorded break-glass access under a defined emergency workflow to address the stated problem. C:This option fits a different fact pattern where a user leaves the company but cloud entitlements remain due to delayed HR synchronization: termination should remove effective access, not just disable one directory account; the current case instead requires issue time-limited, recorded break-glass access under a defined emergency workflow. D:This option fits a different fact pattern where a vendor is removed from a contract but retained API keys still work: ending a contractual relationship alone does not disable technical access; the current case instead requires issue time-limited, recorded break-glass access under a defined emergency workflow.
Question 249 A vendor is removed from a contract but retained API keys still work. What is the essential offboarding action? Revoke third-party keys, roles, tokens and dependent integrations at contract termination Use timely identity lifecycle triggers and verify deprovisioning across all connected services Conduct mover-triggered and scheduled access recertification with privilege removal Check segregation-of-duties conflicts before entitlement activation Explanation Correct Answer A:Ending a contractual relationship alone does not disable technical access. Incorrect Answers B:This option fits a different fact pattern where a user leaves the company but cloud entitlements remain due to delayed HR synchronization: termination should remove effective access, not just disable one directory account; the current case instead requires revoke third-party keys, roles, tokens and dependent integrations at contract termination. C:Privilege accumulation creates excess exposure even when each historical assignment was initially authorized; this responds to the different circumstance in which an engineer is promoted and accumulates legacy privileges from three previous jobs, while the current case states that a vendor is removed from a contract but retained API keys still work, calling for revoke third-party keys, roles, tokens and dependent integrations at contract termination. D:The other scenario states that a manager approves a role without checking incompatible finance duties, where provisioning should detect toxic combinations before they create an unauthorized workflow; by contrast, the present case requires revoke third-party keys, roles, tokens and dependent integrations at contract termination.
Question 250 An access review confirms an account is used but nobody knows its business purpose. What should the reviewer require? Use timely identity lifecycle triggers and verify deprovisioning across all connected services Conduct mover-triggered and scheduled access recertification with privilege removal Identify the accountable owner and justified use before renewing the entitlement Create distinct least-privilege workload identities with traceable ownership Explanation Correct Answer C:Use frequency is not proof of legitimate business authorization. Incorrect Answers A:This option fits a different fact pattern where a user leaves the company but cloud entitlements remain due to delayed HR synchronization: termination should remove effective access, not just disable one directory account; the current case instead requires identify the accountable owner and justified use before renewing the entitlement. B:For the separate situation in which an engineer is promoted and accumulates legacy privileges from three previous jobs, privilege accumulation creates excess exposure even when each historical assignment was initially authorized; here the stated problem requires identify the accountable owner and justified use before renewing the entitlement. D:The other scenario states that a root-level service account is shared across multiple automation jobs, where separation and attribution contain compromise and simplify rotation; by contrast, the present case requires identify the accountable owner and justified use before renewing the entitlement.
