Question 250 An access review confirms an account is used but nobody knows its business purpose. What should the reviewer require? Use timely identity lifecycle triggers and verify deprovisioning across all connected services Conduct mover-triggered and scheduled access recertification with privilege removal Identify the accountable owner and justified use before renewing the entitlement Create distinct least-privilege workload identities with traceable ownership Explanation Correct Answer C:Use frequency is not proof of legitimate business authorization. Incorrect Answers A:This option fits a different fact pattern where a user leaves the company but cloud entitlements remain due to delayed HR synchronization: termination should remove effective access, not just disable one directory account; the current case instead requires identify the accountable owner and justified use before renewing the entitlement. B:For the separate situation in which an engineer is promoted and accumulates legacy privileges from three previous jobs, privilege accumulation creates excess exposure even when each historical assignment was initially authorized; here the stated problem requires identify the accountable owner and justified use before renewing the entitlement. D:The other scenario states that a root-level service account is shared across multiple automation jobs, where separation and attribution contain compromise and simplify rotation; by contrast, the present case requires identify the accountable owner and justified use before renewing the entitlement.
Question 251 A root-level service account is shared across multiple automation jobs. What should replace it? Identify the accountable owner and justified use before renewing the entitlement Conduct mover-triggered and scheduled access recertification with privilege removal Create distinct least-privilege workload identities with traceable ownership Assign a service-account owner and implement reviewed credential rotation and expiry Explanation Correct Answer C:Separation and attribution contain compromise and simplify rotation. Incorrect Answers A:This option fits a different fact pattern where an access review confirms an account is used but nobody knows its business purpose: use frequency is not proof of legitimate business authorization; the current case instead requires create distinct least-privilege workload identities with traceable ownership. B:The other scenario states that an engineer is promoted and accumulates legacy privileges from three previous jobs, where privilege accumulation creates excess exposure even when each historical assignment was initially authorized; by contrast, the present case requires create distinct least-privilege workload identities with traceable ownership. D:Machine identities require lifecycle management and evidence of continued necessity; it is relevant where a noninteractive integration token has no owner and has not rotated for years, whereas the current facts require create distinct least-privilege workload identities with traceable ownership to address the stated problem.
Question 252 A security team sees successful logins after employee disablement because cached sessions remain valid. What should lifecycle closure include? Identify the accountable owner and justified use before renewing the entitlement Assign a service-account owner and implement reviewed credential rotation and expiry Invalidate or limit existing sessions in addition to preventing new authentication Use timely identity lifecycle triggers and verify deprovisioning across all connected services Explanation Correct Answer C:Account deactivation may not terminate all previously issued credentials or tokens. Incorrect Answers A:Use frequency is not proof of legitimate business authorization; it is relevant where an access review confirms an account is used but nobody knows its business purpose, whereas the current facts require invalidate or limit existing sessions in addition to preventing new authentication to address the stated problem. B:For the separate situation in which a noninteractive integration token has no owner and has not rotated for years, machine identities require lifecycle management and evidence of continued necessity; here the stated problem requires invalidate or limit existing sessions in addition to preventing new authentication. D:Termination should remove effective access, not just disable one directory account; this responds to the different circumstance in which a user leaves the company but cloud entitlements remain due to delayed HR synchronization, while the current case states that a security team sees successful logins after employee disablement because cached sessions remain valid, calling for invalidate or limit existing sessions in addition to preventing new authentication.
Question 253 A legacy password login is vulnerable to credential stuffing despite rate limits. What architecture strengthens sign-in? Remove secret-bearing logs and retain only minimal protected diagnostic events Use a modern salted password hashing function with appropriate cost parameters Add phishing-resistant multifactor authentication and compromised-credential controls Revoke the compromised authenticator and perform appropriately verified recovery enrollment Explanation Correct Answer C:A second independent factor and secure credential lifecycle reduce account takeover exposure. Incorrect Answers A:The other scenario states that a developer logs full authentication secrets for debugging failed sign-ins, where authentication diagnostics must not create reusable credentials in a log system; by contrast, the present case requires add phishing-resistant multifactor authentication and compromised-credential controls. B:This option fits a different fact pattern where a ticketing platform stores passwords as plain unsalted hashes: dedicated slow password hashing limits damage from stolen verifier databases; the current case instead requires add phishing-resistant multifactor authentication and compromised-credential controls. D:Continuing to accept a stolen factor defeats the purpose of identity assurance; this responds to the different circumstance in which a user reports a stolen authenticator while the account still permits it for login, while the current case states that a legacy password login is vulnerable to credential stuffing despite rate limits, calling for add phishing-resistant multifactor authentication and compromised-credential controls.
Question 254 A ticketing platform stores passwords as plain unsalted hashes. How should authentication storage change? Define separate authentication flows, credentials and expiry policies for machines and people Remove secret-bearing logs and retain only minimal protected diagnostic events Use origin-bound phishing-resistant authentication rather than replayable codes Use a modern salted password hashing function with appropriate cost parameters Explanation Correct Answer D:Dedicated slow password hashing limits damage from stolen verifier databases. Incorrect Answers A:The other scenario states that a customer portal does not distinguish human sessions from automated service tokens, where workload identities have different lifecycle and interaction requirements from user sessions; by contrast, the present case requires use a modern salted password hashing function with appropriate cost parameters. B:Authentication diagnostics must not create reusable credentials in a log system; although this helps when a developer logs full authentication secrets for debugging failed sign-ins, it leaves the current case's need to use a modern salted password hashing function with appropriate cost parameters unresolved. C:A reverse proxy can relay OTPs, whereas origin-bound authenticators constrain phishing use; it is relevant where an organization uses SMS codes as its only defense against a targeted real-time phishing proxy, whereas the current facts require use a modern salted password hashing function with appropriate cost parameters to address the stated problem.
Question 255 A distributed system accepts identity assertions but never verifies token expiration. What should implementation enforce? Add phishing-resistant multifactor authentication and compromised-credential controls Define separate authentication flows, credentials and expiry policies for machines and people Validate signed token lifetime and audience at the protected resource Apply risk-based detection, protect reset flows and escalate anomalies for investigation Explanation Correct Answer C:Token validity is contextual and time-bounded, not established by mere possession. Incorrect Answers A:This option fits a different fact pattern where a legacy password login is vulnerable to credential stuffing despite rate limits: a second independent factor and secure credential lifecycle reduce account takeover exposure; the current case instead requires validate signed token lifetime and audience at the protected resource. B:Workload identities have different lifecycle and interaction requirements from user sessions; although this helps when a customer portal does not distinguish human sessions from automated service tokens, it leaves the current case's need to validate signed token lifetime and audience at the protected resource unresolved. D:The other scenario states that an authentication server receives repeated credential reset attempts from unexpected locations, where recovery is a privileged security operation that needs abuse prevention and audit; by contrast, the present case requires validate signed token lifetime and audience at the protected resource.
Question 256 A developer logs full authentication secrets for debugging failed sign-ins. What needs to change? Add phishing-resistant multifactor authentication and compromised-credential controls Use origin-bound phishing-resistant authentication rather than replayable codes Use a modern salted password hashing function with appropriate cost parameters Remove secret-bearing logs and retain only minimal protected diagnostic events Explanation Correct Answer D:Authentication diagnostics must not create reusable credentials in a log system. Incorrect Answers A:A second independent factor and secure credential lifecycle reduce account takeover exposure; it is relevant where a legacy password login is vulnerable to credential stuffing despite rate limits, whereas the current facts require remove secret-bearing logs and retain only minimal protected diagnostic events to address the stated problem. B:The other scenario states that an organization uses SMS codes as its only defense against a targeted real-time phishing proxy, where a reverse proxy can relay OTPs, whereas origin-bound authenticators constrain phishing use; by contrast, the present case requires remove secret-bearing logs and retain only minimal protected diagnostic events. C:For the separate situation in which a ticketing platform stores passwords as plain unsalted hashes, dedicated slow password hashing limits damage from stolen verifier databases; here the stated problem requires remove secret-bearing logs and retain only minimal protected diagnostic events.
Question 257 A user reports a stolen authenticator while the account still permits it for login. What is the immediate corrective action? Revoke the compromised authenticator and perform appropriately verified recovery enrollment Validate signed token lifetime and audience at the protected resource Add phishing-resistant multifactor authentication and compromised-credential controls Define separate authentication flows, credentials and expiry policies for machines and people Explanation Correct Answer A:Continuing to accept a stolen factor defeats the purpose of identity assurance. Incorrect Answers B:This option fits a different fact pattern where a distributed system accepts identity assertions but never verifies token expiration: token validity is contextual and time-bounded, not established by mere possession; the current case instead requires revoke the compromised authenticator and perform appropriately verified recovery enrollment. C:The other scenario states that a legacy password login is vulnerable to credential stuffing despite rate limits, where a second independent factor and secure credential lifecycle reduce account takeover exposure; by contrast, the present case requires revoke the compromised authenticator and perform appropriately verified recovery enrollment. D:Workload identities have different lifecycle and interaction requirements from user sessions; although this helps when a customer portal does not distinguish human sessions from automated service tokens, it leaves the current case's need to revoke the compromised authenticator and perform appropriately verified recovery enrollment unresolved.
Question 258 A customer portal does not distinguish human sessions from automated service tokens. What should be redesigned? Remove secret-bearing logs and retain only minimal protected diagnostic events Use a modern salted password hashing function with appropriate cost parameters Define separate authentication flows, credentials and expiry policies for machines and people Validate signed token lifetime and audience at the protected resource Explanation Correct Answer C:Workload identities have different lifecycle and interaction requirements from user sessions. Incorrect Answers A:Authentication diagnostics must not create reusable credentials in a log system; this responds to the different circumstance in which a developer logs full authentication secrets for debugging failed sign-ins, while the current case states that a customer portal does not distinguish human sessions from automated service tokens, calling for define separate authentication flows, credentials and expiry policies for machines and people. B:This option fits a different fact pattern where a ticketing platform stores passwords as plain unsalted hashes: dedicated slow password hashing limits damage from stolen verifier databases; the current case instead requires define separate authentication flows, credentials and expiry policies for machines and people. D:Token validity is contextual and time-bounded, not established by mere possession; it is relevant where a distributed system accepts identity assertions but never verifies token expiration, whereas the current facts require define separate authentication flows, credentials and expiry policies for machines and people to address the stated problem.
Question 259 An organization uses SMS codes as its only defense against a targeted real-time phishing proxy. What change better meets the threat? Remove secret-bearing logs and retain only minimal protected diagnostic events Use origin-bound phishing-resistant authentication rather than replayable codes Use a modern salted password hashing function with appropriate cost parameters Apply risk-based detection, protect reset flows and escalate anomalies for investigation Explanation Correct Answer B:A reverse proxy can relay OTPs, whereas origin-bound authenticators constrain phishing use. Incorrect Answers A:The other scenario states that a developer logs full authentication secrets for debugging failed sign-ins, where authentication diagnostics must not create reusable credentials in a log system; by contrast, the present case requires use origin-bound phishing-resistant authentication rather than replayable codes. C:Dedicated slow password hashing limits damage from stolen verifier databases; although this helps when a ticketing platform stores passwords as plain unsalted hashes, it leaves the current case's need to use origin-bound phishing-resistant authentication rather than replayable codes unresolved. D:Recovery is a privileged security operation that needs abuse prevention and audit; it is relevant where an authentication server receives repeated credential reset attempts from unexpected locations, whereas the current facts require use origin-bound phishing-resistant authentication rather than replayable codes to address the stated problem.
Question 260 An authentication server receives repeated credential reset attempts from unexpected locations. What should it do? Define separate authentication flows, credentials and expiry policies for machines and people Add phishing-resistant multifactor authentication and compromised-credential controls Apply risk-based detection, protect reset flows and escalate anomalies for investigation Remove secret-bearing logs and retain only minimal protected diagnostic events Explanation Correct Answer C:Recovery is a privileged security operation that needs abuse prevention and audit. Incorrect Answers A:Workload identities have different lifecycle and interaction requirements from user sessions; although this helps when a customer portal does not distinguish human sessions from automated service tokens, it leaves the current case's need to apply risk-based detection, protect reset flows and escalate anomalies for investigation unresolved. B:A second independent factor and secure credential lifecycle reduce account takeover exposure; it is relevant where a legacy password login is vulnerable to credential stuffing despite rate limits, whereas the current facts require apply risk-based detection, protect reset flows and escalate anomalies for investigation to address the stated problem. D:The other scenario states that a developer logs full authentication secrets for debugging failed sign-ins, where authentication diagnostics must not create reusable credentials in a log system; by contrast, the present case requires apply risk-based detection, protect reset flows and escalate anomalies for investigation.
