Question 280 A CI pipeline contains SAST but never checks third-party dependency risks. Which testing discipline is missing? Validate signed artifact provenance and trusted-boot behavior Use configuration and dynamic testing as well as source inspection Add software composition analysis and dependency vulnerability review Extend authorized testing to relevant internal interfaces and trust boundaries Explanation Correct Answer C:Static first-party code analysis may not identify vulnerable included packages. Incorrect Answers A:The other scenario states that a new firmware build passes vulnerability scanning but fails authenticity checks, where absence of known vulnerabilities does not prove that firmware is authentic; by contrast, the present case requires add software composition analysis and dependency vulnerability review. B:Static review sees code structure, while deployed behavior also depends on runtime configuration; it is relevant where a product owner asks whether a code review can find runtime misconfigurations in production, whereas the current facts require add software composition analysis and dependency vulnerability review to address the stated problem. D:This option fits a different fact pattern where a web scanner runs only against public URLs and misses insecure internal service endpoints: exposure is not limited to routes indexed by an external crawler; the current case instead requires add software composition analysis and dependency vulnerability review.
Question 281 A company treats a vulnerability scanner's severity as identical to business risk. What should prioritization consider? Assess reachability, exploitability, asset criticality and potential impact Add software composition analysis and dependency vulnerability review Benchmark security effectiveness and throughput under representative malicious traffic Extend authorized testing to relevant internal interfaces and trust boundaries Explanation Correct Answer A:A scan severity score lacks environmental consequence and compensating-control context. Incorrect Answers B:For the separate situation in which a CI pipeline contains SAST but never checks third-party dependency risks, static first-party code analysis may not identify vulnerable included packages; here the stated problem requires assess reachability, exploitability, asset criticality and potential impact. C:The other scenario states that a business compares two security gateways using average CPU utilization only, where performance numbers alone cannot show whether a gateway blocks required attack classes; by contrast, the present case requires assess reachability, exploitability, asset criticality and potential impact. D:Exposure is not limited to routes indexed by an external crawler; although this helps when a web scanner runs only against public URLs and misses insecure internal service endpoints, it leaves the current case's need to assess reachability, exploitability, asset criticality and potential impact unresolved.
Question 282 A team scans a database and reports success even though its service account could read only metadata. What should the report state? Extend authorized testing to relevant internal interfaces and trust boundaries Assess reachability, exploitability, asset criticality and potential impact Run coordinated red-blue or purple-team validation with detection and response observations Disclose test coverage limitations and request authorized deeper verification Explanation Correct Answer D:Inability to inspect protected objects cannot be presented as evidence of their security. Incorrect Answers A:Exposure is not limited to routes indexed by an external crawler; this responds to the different circumstance in which a web scanner runs only against public URLs and misses insecure internal service endpoints, while the current case states that a team scans a database and reports success even though its service account could read only metadata, calling for disclose test coverage limitations and request authorized deeper verification. B:A scan severity score lacks environmental consequence and compensating-control context; this responds to the different circumstance in which a company treats a vulnerability scanner's severity as identical to business risk, while the current case states that a team scans a database and reports success even though its service account could read only metadata, calling for disclose test coverage limitations and request authorized deeper verification. C:The other scenario states that a cloud intrusion exercise tests attack techniques but never evaluates the response team's actions, where adversary emulation is more useful when it measures controls and defender behavior; by contrast, the present case requires disclose test coverage limitations and request authorized deeper verification.
Question 283 A cloud intrusion exercise tests attack techniques but never evaluates the response team's actions. What exercise improves learning? Run coordinated red-blue or purple-team validation with detection and response observations Perform malformed-input and interface security tests including error paths Exercise controlled negative requests and verify both blocking and false-positive impacts Extend authorized testing to relevant internal interfaces and trust boundaries Explanation Correct Answer A:Adversary emulation is more useful when it measures controls and defender behavior. Incorrect Answers B:Boundary testing exposes parsing and validation weaknesses that nominal calls miss; this responds to the different circumstance in which a new API can accept malformed request bodies without validation, while the current case states that a cloud intrusion exercise tests attack techniques but never evaluates the response team's actions, calling for run coordinated red-blue or purple-team validation with detection and response observations. C:This option fits a different fact pattern where a security team wants to determine if a WAF blocks an SQL injection pattern after tuning: rule presence does not establish effectiveness or acceptable service impact; the current case instead requires run coordinated red-blue or purple-team validation with detection and response observations. D:This option fits a different fact pattern where a web scanner runs only against public URLs and misses insecure internal service endpoints: exposure is not limited to routes indexed by an external crawler; the current case instead requires run coordinated red-blue or purple-team validation with detection and response observations.
Question 284 A new firmware build passes vulnerability scanning but fails authenticity checks. Which security test should be performed? Capture authorized, reproducible evidence and scope-limited exploit details Validate signed artifact provenance and trusted-boot behavior Add software composition analysis and dependency vulnerability review Run a controlled breach-and-attack simulation with defined expected telemetry Explanation Correct Answer B:Absence of known vulnerabilities does not prove that firmware is authentic. Incorrect Answers A:A finding needs trustworthy context for validation and remediation; although this helps when a penetration test successfully elevates privileges but the tester did not preserve supporting evidence, it leaves the current case's need to validate signed artifact provenance and trusted-boot behavior unresolved. C:Static first-party code analysis may not identify vulnerable included packages; this responds to the different circumstance in which a CI pipeline contains SAST but never checks third-party dependency risks, while the current case states that a new firmware build passes vulnerability scanning but fails authenticity checks, calling for validate signed artifact provenance and trusted-boot behavior. D:A controlled replay tests the end-to-end detection path, not just rule existence; it is relevant where a SOC wants proof that its detection rule fires for a realistic known attack technique, whereas the current facts require validate signed artifact provenance and trusted-boot behavior to address the stated problem.
Question 285 A company tracks successful backups but never validates a restore. What process evidence is missing? Measure applied patch state, exceptions and remediation times against thresholds Collect periodic restore test results against recovery objectives Record exercise failures, owners, corrective actions and re-test evidence Preserve attributable access approvals and later access-review evidence Explanation Correct Answer B:Backup job completion is not proof that usable systems or data can be recovered. Incorrect Answers A:Deployment actions need independent state verification to support compliance conclusions; it is relevant where a company claims all patches meet policy because a script was deployed, whereas the current facts require collect periodic restore test results against recovery objectives to address the stated problem. C:The other scenario states that a disaster recovery drill discovers a contact list with obsolete phone numbers, where process improvement requires traceable remediation of demonstrated weaknesses; by contrast, the present case requires collect periodic restore test results against recovery objectives. D:Documented approvals demonstrate that permissions are intentional and still justified; it is relevant where privileged accounts are approved by email but no one retains decisions, whereas the current facts require collect periodic restore test results against recovery objectives to address the stated problem.
Question 286 Privileged accounts are approved by email but no one retains decisions. Which process record is needed? Collect periodic restore test results against recovery objectives Record exercise failures, owners, corrective actions and re-test evidence Preserve attributable access approvals and later access-review evidence Cross-check reviewer authority and current manager ownership for approvals Explanation Correct Answer C:Documented approvals demonstrate that permissions are intentional and still justified. Incorrect Answers A:Backup job completion is not proof that usable systems or data can be recovered; it is relevant where a company tracks successful backups but never validates a restore, whereas the current facts require preserve attributable access approvals and later access-review evidence to address the stated problem. B:Process improvement requires traceable remediation of demonstrated weaknesses; this responds to the different circumstance in which a disaster recovery drill discovers a contact list with obsolete phone numbers, while the current case states that privileged accounts are approved by email but no one retains decisions, calling for preserve attributable access approvals and later access-review evidence. D:This option fits a different fact pattern where a department's user access recertifications are signed by a former manager: a signature is weak evidence if the approver lacked responsibility at review time; the current case instead requires preserve attributable access approvals and later access-review evidence.
Question 287 A risk dashboard displays thousands of firewall events without any governance objective. What data should replace this? Record exercise failures, owners, corrective actions and re-test evidence Capture exercise observations and incorporate approved procedural revisions Collect behavior and reporting effectiveness measures as well as attendance Track key risk and performance indicators tied to control objectives Explanation Correct Answer D:Metrics are valuable when they support decisions about meaningful risk or effectiveness. Incorrect Answers A:For the separate situation in which a disaster recovery drill discovers a contact list with obsolete phone numbers, process improvement requires traceable remediation of demonstrated weaknesses; here the stated problem requires track key risk and performance indicators tied to control objectives. B:A tested process depends on feedback and version-controlled improvement; although this helps when an incident response procedure changes but no one records tabletop lessons, it leaves the current case's need to track key risk and performance indicators tied to control objectives unresolved. C:Training participation alone does not quantify practical response capability; this responds to the different circumstance in which security awareness attendance is high while successful phishing reports remain low, while the current case states that a risk dashboard displays thousands of firewall events without any governance objective, calling for track key risk and performance indicators tied to control objectives.
Question 288 Security awareness attendance is high while successful phishing reports remain low. What should be measured? Collect behavior and reporting effectiveness measures as well as attendance Track key risk and performance indicators tied to control objectives Cross-check reviewer authority and current manager ownership for approvals Capture exercise observations and incorporate approved procedural revisions Explanation Correct Answer A:Training participation alone does not quantify practical response capability. Incorrect Answers B:For the separate situation in which a risk dashboard displays thousands of firewall events without any governance objective, metrics are valuable when they support decisions about meaningful risk or effectiveness; here the stated problem requires collect behavior and reporting effectiveness measures as well as attendance. C:For the separate situation in which a department's user access recertifications are signed by a former manager, a signature is weak evidence if the approver lacked responsibility at review time; here the stated problem requires collect behavior and reporting effectiveness measures as well as attendance. D:This option fits a different fact pattern where an incident response procedure changes but no one records tabletop lessons: a tested process depends on feedback and version-controlled improvement; the current case instead requires collect behavior and reporting effectiveness measures as well as attendance.
Question 289 A disaster recovery drill discovers a contact list with obsolete phone numbers. What should the program collect? Preserve attributable access approvals and later access-review evidence Record exercise failures, owners, corrective actions and re-test evidence Measure applied patch state, exceptions and remediation times against thresholds Capture exercise observations and incorporate approved procedural revisions Explanation Correct Answer B:Process improvement requires traceable remediation of demonstrated weaknesses. Incorrect Answers A:Documented approvals demonstrate that permissions are intentional and still justified; this responds to the different circumstance in which privileged accounts are approved by email but no one retains decisions, while the current case states that a disaster recovery drill discovers a contact list with obsolete phone numbers, calling for record exercise failures, owners, corrective actions and re-test evidence. C:This option fits a different fact pattern where a company claims all patches meet policy because a script was deployed: deployment actions need independent state verification to support compliance conclusions; the current case instead requires record exercise failures, owners, corrective actions and re-test evidence. D:The other scenario states that an incident response procedure changes but no one records tabletop lessons, where a tested process depends on feedback and version-controlled improvement; by contrast, the present case requires record exercise failures, owners, corrective actions and re-test evidence.
Question 290 A department's user access recertifications are signed by a former manager. What should auditors verify? Track key risk and performance indicators tied to control objectives Record exercise failures, owners, corrective actions and re-test evidence Measure applied patch state, exceptions and remediation times against thresholds Cross-check reviewer authority and current manager ownership for approvals Explanation Correct Answer D:A signature is weak evidence if the approver lacked responsibility at review time. Incorrect Answers A:Metrics are valuable when they support decisions about meaningful risk or effectiveness; it is relevant where a risk dashboard displays thousands of firewall events without any governance objective, whereas the current facts require cross-check reviewer authority and current manager ownership for approvals to address the stated problem. B:The other scenario states that a disaster recovery drill discovers a contact list with obsolete phone numbers, where process improvement requires traceable remediation of demonstrated weaknesses; by contrast, the present case requires cross-check reviewer authority and current manager ownership for approvals. C:Deployment actions need independent state verification to support compliance conclusions; although this helps when a company claims all patches meet policy because a script was deployed, it leaves the current case's need to cross-check reviewer authority and current manager ownership for approvals unresolved.
