Question 260 An authentication server receives repeated credential reset attempts from unexpected locations. What should it do? Define separate authentication flows, credentials and expiry policies for machines and people Add phishing-resistant multifactor authentication and compromised-credential controls Apply risk-based detection, protect reset flows and escalate anomalies for investigation Remove secret-bearing logs and retain only minimal protected diagnostic events Explanation Correct Answer C:Recovery is a privileged security operation that needs abuse prevention and audit. Incorrect Answers A:Workload identities have different lifecycle and interaction requirements from user sessions; although this helps when a customer portal does not distinguish human sessions from automated service tokens, it leaves the current case's need to apply risk-based detection, protect reset flows and escalate anomalies for investigation unresolved. B:A second independent factor and secure credential lifecycle reduce account takeover exposure; it is relevant where a legacy password login is vulnerable to credential stuffing despite rate limits, whereas the current facts require apply risk-based detection, protect reset flows and escalate anomalies for investigation to address the stated problem. D:The other scenario states that a developer logs full authentication secrets for debugging failed sign-ins, where authentication diagnostics must not create reusable credentials in a log system; by contrast, the present case requires apply risk-based detection, protect reset flows and escalate anomalies for investigation.
Question 261 A red team wants to exploit a bank's live payment system without any agreed limits. What must happen before testing? Coordinate authorized testing with availability and restoration constraints Agree on written authorization, boundaries, safety rules and escalation contacts Provide adequate independent oversight and avoid conflicts in the audit mandate Maintain complementary controls-based audits alongside targeted exploitation testing Explanation Correct Answer B:A valid engagement requires explicit consent and scope before potentially disruptive activity. Incorrect Answers A:For the separate situation in which an annual scan may disrupt an unavailable but critical recovery platform, a control test should not create unacceptable damage to the asset it evaluates; here the stated problem requires agree on written authorization, boundaries, safety rules and escalation contacts. C:Review objectivity is weakened when auditors are accountable for the system they are judging; it is relevant where an internal audit team plans to assess controls it designed and operates, whereas the current facts require agree on written authorization, boundaries, safety rules and escalation contacts to address the stated problem. D:A penetration test finds exploitable paths but is not a complete governance and compliance assessment; although this helps when a system administrator wants a penetration test to replace the organization's recurring compliance audit, it leaves the current case's need to agree on written authorization, boundaries, safety rules and escalation contacts unresolved.
Question 262 An internal audit team plans to assess controls it designed and operates. What should governance address? Define effectiveness criteria and observable outcomes for each tested control Provide adequate independent oversight and avoid conflicts in the audit mandate Map relevant dependencies and shared-responsibility boundaries into assessment scope Coordinate authorized testing with availability and restoration constraints Explanation Correct Answer B:Review objectivity is weakened when auditors are accountable for the system they are judging. Incorrect Answers A:For the separate situation in which a test program measures only control installation, not whether the control works, existence of a configuration is not proof of operational security performance; here the stated problem requires provide adequate independent oversight and avoid conflicts in the audit mandate. C:This option fits a different fact pattern where a security assessment covers a cloud service but excludes the managed identity provider that controls it: testing only a workload can miss the security controls on which it depends; the current case instead requires provide adequate independent oversight and avoid conflicts in the audit mandate. D:A control test should not create unacceptable damage to the asset it evaluates; it is relevant where an annual scan may disrupt an unavailable but critical recovery platform, whereas the current facts require provide adequate independent oversight and avoid conflicts in the audit mandate to address the stated problem.
Question 263 A security assessment covers a cloud service but excludes the managed identity provider that controls it. What should the strategy include? Use passive assessments and approved maintenance windows backed by safety review Coordinate authorized testing with availability and restoration constraints Map relevant dependencies and shared-responsibility boundaries into assessment scope Define effectiveness criteria and observable outcomes for each tested control Explanation Correct Answer C:Testing only a workload can miss the security controls on which it depends. Incorrect Answers A:Safety-critical environments need non-disruptive techniques chosen to fit operational risk; although this helps when a manufacturer cannot halt production for intrusive scanning, it leaves the current case's need to map relevant dependencies and shared-responsibility boundaries into assessment scope unresolved. B:A control test should not create unacceptable damage to the asset it evaluates; this responds to the different circumstance in which an annual scan may disrupt an unavailable but critical recovery platform, while the current case states that a security assessment covers a cloud service but excludes the managed identity provider that controls it, calling for map relevant dependencies and shared-responsibility boundaries into assessment scope. D:Existence of a configuration is not proof of operational security performance; it is relevant where a test program measures only control installation, not whether the control works, whereas the current facts require map relevant dependencies and shared-responsibility boundaries into assessment scope to address the stated problem.
Question 264 An organization asks a third party to attest security without providing access to evidence. What should the plan specify? Define evidence access, test methods, criteria and reporting limitations before engagement Use passive assessments and approved maintenance windows backed by safety review Define effectiveness criteria and observable outcomes for each tested control Agree on written authorization, boundaries, safety rules and escalation contacts Explanation Correct Answer A:Independent conclusions require a workable evidence basis and transparent scope constraints. Incorrect Answers B:Safety-critical environments need non-disruptive techniques chosen to fit operational risk; it is relevant where a manufacturer cannot halt production for intrusive scanning, whereas the current facts require define evidence access, test methods, criteria and reporting limitations before engagement to address the stated problem. C:Existence of a configuration is not proof of operational security performance; it is relevant where a test program measures only control installation, not whether the control works, whereas the current facts require define evidence access, test methods, criteria and reporting limitations before engagement to address the stated problem. D:A valid engagement requires explicit consent and scope before potentially disruptive activity; although this helps when a red team wants to exploit a bank's live payment system without any agreed limits, it leaves the current case's need to define evidence access, test methods, criteria and reporting limitations before engagement unresolved.
Question 265 A manufacturer cannot halt production for intrusive scanning. How should the test strategy adapt? Provide adequate independent oversight and avoid conflicts in the audit mandate Use passive assessments and approved maintenance windows backed by safety review Map relevant dependencies and shared-responsibility boundaries into assessment scope Coordinate authorized testing with availability and restoration constraints Explanation Correct Answer B:Safety-critical environments need non-disruptive techniques chosen to fit operational risk. Incorrect Answers A:Review objectivity is weakened when auditors are accountable for the system they are judging; it is relevant where an internal audit team plans to assess controls it designed and operates, whereas the current facts require use passive assessments and approved maintenance windows backed by safety review to address the stated problem. C:For the separate situation in which a security assessment covers a cloud service but excludes the managed identity provider that controls it, testing only a workload can miss the security controls on which it depends; here the stated problem requires use passive assessments and approved maintenance windows backed by safety review. D:This option fits a different fact pattern where an annual scan may disrupt an unavailable but critical recovery platform: a control test should not create unacceptable damage to the asset it evaluates; the current case instead requires use passive assessments and approved maintenance windows backed by safety review.
Question 266 A supplier proposes a generic checklist that misses the customer's threat model. What should validation do? Coordinate authorized testing with availability and restoration constraints Agree on written authorization, boundaries, safety rules and escalation contacts Identify jurisdictions, hosting locations and responsible third parties within test scope Align tests with asset criticality, credible attack paths and required control outcomes Explanation Correct Answer D:A static checklist alone may not address the organization's important failure modes. Incorrect Answers A:This option fits a different fact pattern where an annual scan may disrupt an unavailable but critical recovery platform: a control test should not create unacceptable damage to the asset it evaluates; the current case instead requires align tests with asset criticality, credible attack paths and required control outcomes. B:A valid engagement requires explicit consent and scope before potentially disruptive activity; it is relevant where a red team wants to exploit a bank's live payment system without any agreed limits, whereas the current facts require align tests with asset criticality, credible attack paths and required control outcomes to address the stated problem. C:Compliance evidence must reflect where data and operations actually reside; this responds to the different circumstance in which a multinational needs audit coverage for a new data residency requirement, while the current case states that a supplier proposes a generic checklist that misses the customer's threat model, calling for align tests with asset criticality, credible attack paths and required control outcomes.
Question 267 A test program measures only control installation, not whether the control works. What should be added? Coordinate authorized testing with availability and restoration constraints Map relevant dependencies and shared-responsibility boundaries into assessment scope Agree on written authorization, boundaries, safety rules and escalation contacts Define effectiveness criteria and observable outcomes for each tested control Explanation Correct Answer D:Existence of a configuration is not proof of operational security performance. Incorrect Answers A:A control test should not create unacceptable damage to the asset it evaluates; this responds to the different circumstance in which an annual scan may disrupt an unavailable but critical recovery platform, while the current case states that a test program measures only control installation, not whether the control works, calling for define effectiveness criteria and observable outcomes for each tested control. B:Testing only a workload can miss the security controls on which it depends; this responds to the different circumstance in which a security assessment covers a cloud service but excludes the managed identity provider that controls it, while the current case states that a test program measures only control installation, not whether the control works, calling for define effectiveness criteria and observable outcomes for each tested control. C:This option fits a different fact pattern where a red team wants to exploit a bank's live payment system without any agreed limits: a valid engagement requires explicit consent and scope before potentially disruptive activity; the current case instead requires define effectiveness criteria and observable outcomes for each tested control.
Question 268 A multinational needs audit coverage for a new data residency requirement. What must its plan distinguish? Coordinate authorized testing with availability and restoration constraints Maintain complementary controls-based audits alongside targeted exploitation testing Identify jurisdictions, hosting locations and responsible third parties within test scope Map relevant dependencies and shared-responsibility boundaries into assessment scope Explanation Correct Answer C:Compliance evidence must reflect where data and operations actually reside. Incorrect Answers A:This option fits a different fact pattern where an annual scan may disrupt an unavailable but critical recovery platform: a control test should not create unacceptable damage to the asset it evaluates; the current case instead requires identify jurisdictions, hosting locations and responsible third parties within test scope. B:A penetration test finds exploitable paths but is not a complete governance and compliance assessment; it is relevant where a system administrator wants a penetration test to replace the organization's recurring compliance audit, whereas the current facts require identify jurisdictions, hosting locations and responsible third parties within test scope to address the stated problem. D:Testing only a workload can miss the security controls on which it depends; this responds to the different circumstance in which a security assessment covers a cloud service but excludes the managed identity provider that controls it, while the current case states that a multinational needs audit coverage for a new data residency requirement, calling for identify jurisdictions, hosting locations and responsible third parties within test scope.
Question 269 An annual scan may disrupt an unavailable but critical recovery platform. What should assessment planning require? Identify jurisdictions, hosting locations and responsible third parties within test scope Coordinate authorized testing with availability and restoration constraints Define evidence access, test methods, criteria and reporting limitations before engagement Provide adequate independent oversight and avoid conflicts in the audit mandate Explanation Correct Answer B:A control test should not create unacceptable damage to the asset it evaluates. Incorrect Answers A:Compliance evidence must reflect where data and operations actually reside; it is relevant where a multinational needs audit coverage for a new data residency requirement, whereas the current facts require coordinate authorized testing with availability and restoration constraints to address the stated problem. C:Independent conclusions require a workable evidence basis and transparent scope constraints; this responds to the different circumstance in which an organization asks a third party to attest security without providing access to evidence, while the current case states that an annual scan may disrupt an unavailable but critical recovery platform, calling for coordinate authorized testing with availability and restoration constraints. D:The other scenario states that an internal audit team plans to assess controls it designed and operates, where review objectivity is weakened when auditors are accountable for the system they are judging; by contrast, the present case requires coordinate authorized testing with availability and restoration constraints.
Question 270 A system administrator wants a penetration test to replace the organization's recurring compliance audit. What is the limitation? Use passive assessments and approved maintenance windows backed by safety review Maintain complementary controls-based audits alongside targeted exploitation testing Identify jurisdictions, hosting locations and responsible third parties within test scope Agree on written authorization, boundaries, safety rules and escalation contacts Explanation Correct Answer B:A penetration test finds exploitable paths but is not a complete governance and compliance assessment. Incorrect Answers A:For the separate situation in which a manufacturer cannot halt production for intrusive scanning, safety-critical environments need non-disruptive techniques chosen to fit operational risk; here the stated problem requires maintain complementary controls-based audits alongside targeted exploitation testing. C:This option fits a different fact pattern where a multinational needs audit coverage for a new data residency requirement: compliance evidence must reflect where data and operations actually reside; the current case instead requires maintain complementary controls-based audits alongside targeted exploitation testing. D:This option fits a different fact pattern where a red team wants to exploit a bank's live payment system without any agreed limits: a valid engagement requires explicit consent and scope before potentially disruptive activity; the current case instead requires maintain complementary controls-based audits alongside targeted exploitation testing.
