Question 360 Employees receive repeated fraudulent MFA pushes and approve them to stop notifications. What should awareness and technology address? Use a properly tuned prevention control with safe enforcement and escalation Use phishing-resistant authentication and train employees to report push-fatigue attacks Provide discreet duress signaling and a trained safe-response process Apply travel risk review, emergency contact and protective personnel procedures Explanation Correct Answer B:Repeated MFA prompts can manipulate users; alerting and stronger factors reduce this risk. Incorrect Answers A:Detection-only monitoring does not automatically block attack traffic; it is relevant where a network team runs IDS signatures but no control can stop a confirmed exploit in progress, whereas the current facts require use phishing-resistant authentication and train employees to report push-fatigue attacks to address the stated problem. C:Personnel protection requires minimizing harm rather than relying only on door access controls; although this helps when a worker under duress is forced to open a controlled facility door, it leaves the current case's need to use phishing-resistant authentication and train employees to report push-fatigue attacks unresolved. D:For the separate situation in which an employee receives credible threats while traveling to a high-risk site, duty of care extends security planning to employee safety outside offices; here the stated problem requires use phishing-resistant authentication and train employees to report push-fatigue attacks.
Question 361 A product team adds security review only after a release candidate is built. What lifecycle change is most effective? Automate traceable approval, testing and change records within the delivery workflow Define backward-compatible rollout and tested recovery paths before migration Protect pipeline policy changes with independent review and restricted administrative rights Embed risk assessment and security requirements into early design and development gates Explanation Correct Answer D:Early security engagement reduces expensive architectural rework and overlooked abuse paths. Incorrect Answers A:For the separate situation in which an agile development team interprets frequent deployments as permission to skip change documentation, rapid iteration can retain auditability and risk-based control without heavy manual handoffs; here the stated problem requires embed risk assessment and security requirements into early design and development gates. B:Database changes can cause irreversible operational impacts without explicit transition planning; although this helps when a development team plans a major data schema migration but no recovery or rollback strategy, it leaves the current case's need to embed risk assessment and security requirements into early design and development gates unresolved. C:Release governance depends on controlling the mechanism that enforces the gates; although this helps when a system's release process allows developers to bypass required approvals by editing pipeline configuration, it leaves the current case's need to embed risk assessment and security requirements into early design and development gates unresolved.
Question 362 An agile development team interprets frequent deployments as permission to skip change documentation. What should governance require? Embed risk assessment and security requirements into early design and development gates Document measurable security and privacy acceptance requirements with stakeholders Define backward-compatible rollout and tested recovery paths before migration Automate traceable approval, testing and change records within the delivery workflow Explanation Correct Answer D:Rapid iteration can retain auditability and risk-based control without heavy manual handoffs. Incorrect Answers A:The other scenario states that a product team adds security review only after a release candidate is built, where early security engagement reduces expensive architectural rework and overlooked abuse paths; by contrast, the present case requires automate traceable approval, testing and change records within the delivery workflow. B:For the separate situation in which a new project selects a framework without defining security acceptance criteria, requirements must be testable before implementation can be meaningfully validated; here the stated problem requires automate traceable approval, testing and change records within the delivery workflow. C:For the separate situation in which a development team plans a major data schema migration but no recovery or rollback strategy, database changes can cause irreversible operational impacts without explicit transition planning; here the stated problem requires automate traceable approval, testing and change records within the delivery workflow.
Question 363 A new project selects a framework without defining security acceptance criteria. What should its lifecycle establish? Include automated code, dependency and policy checks as release gates with governed exceptions Define backward-compatible rollout and tested recovery paths before migration Document measurable security and privacy acceptance requirements with stakeholders Embed risk assessment and security requirements into early design and development gates Explanation Correct Answer C:Requirements must be testable before implementation can be meaningfully validated. Incorrect Answers A:DevSecOps shifts security verification into continuous delivery rather than post-release cleanup; although this helps when a DevOps pipeline promotes artifacts with no security checks because deadlines are tight, it leaves the current case's need to document measurable security and privacy acceptance requirements with stakeholders unresolved. B:Database changes can cause irreversible operational impacts without explicit transition planning; this responds to the different circumstance in which a development team plans a major data schema migration but no recovery or rollback strategy, while the current case states that a new project selects a framework without defining security acceptance criteria, calling for document measurable security and privacy acceptance requirements with stakeholders. D:The other scenario states that a product team adds security review only after a release candidate is built, where early security engagement reduces expensive architectural rework and overlooked abuse paths; by contrast, the present case requires document measurable security and privacy acceptance requirements with stakeholders.
Question 364 A DevOps pipeline promotes artifacts with no security checks because deadlines are tight. Which integration is appropriate? Protect pipeline policy changes with independent review and restricted administrative rights Include automated code, dependency and policy checks as release gates with governed exceptions Embed risk assessment and security requirements into early design and development gates Automate traceable approval, testing and change records within the delivery workflow Explanation Correct Answer B:DevSecOps shifts security verification into continuous delivery rather than post-release cleanup. Incorrect Answers A:For the separate situation in which a system's release process allows developers to bypass required approvals by editing pipeline configuration, release governance depends on controlling the mechanism that enforces the gates; here the stated problem requires include automated code, dependency and policy checks as release gates with governed exceptions. C:Early security engagement reduces expensive architectural rework and overlooked abuse paths; this responds to the different circumstance in which a product team adds security review only after a release candidate is built, while the current case states that a DevOps pipeline promotes artifacts with no security checks because deadlines are tight, calling for include automated code, dependency and policy checks as release gates with governed exceptions. D:This option fits a different fact pattern where an agile development team interprets frequent deployments as permission to skip change documentation: rapid iteration can retain auditability and risk-based control without heavy manual handoffs; the current case instead requires include automated code, dependency and policy checks as release gates with governed exceptions.
Question 365 A large software program has wildly different security processes across teams and no improvement metrics. What should be evaluated? Assess software-security maturity and establish a measured improvement roadmap Define backward-compatible rollout and tested recovery paths before migration Automate traceable approval, testing and change records within the delivery workflow Document measurable security and privacy acceptance requirements with stakeholders Explanation Correct Answer A:Maturity models help prioritize repeatable process improvements rather than one-off tool purchases. Incorrect Answers B:Database changes can cause irreversible operational impacts without explicit transition planning; this responds to the different circumstance in which a development team plans a major data schema migration but no recovery or rollback strategy, while the current case states that a large software program has wildly different security processes across teams and no improvement metrics, calling for assess software-security maturity and establish a measured improvement roadmap. C:Rapid iteration can retain auditability and risk-based control without heavy manual handoffs; it is relevant where an agile development team interprets frequent deployments as permission to skip change documentation, whereas the current facts require assess software-security maturity and establish a measured improvement roadmap to address the stated problem. D:The other scenario states that a new project selects a framework without defining security acceptance criteria, where requirements must be testable before implementation can be meaningfully validated; by contrast, the present case requires assess software-security maturity and establish a measured improvement roadmap.
Question 366 A legacy application remains operational but its maintenance owner has left. What must the SDLC cover? Protect pipeline policy changes with independent review and restricted administrative rights Automate traceable approval, testing and change records within the delivery workflow Assign operational support, vulnerability response and eventual retirement responsibilities Embed risk assessment and security requirements into early design and development gates Explanation Correct Answer C:Security responsibility continues after launch: assign accountable maintainers for patches, incident response, operational support and controlled retirement so an unsupported legacy system does not retain unmanaged risk. Incorrect Answers A:The other scenario states that a system's release process allows developers to bypass required approvals by editing pipeline configuration, where release governance depends on controlling the mechanism that enforces the gates; by contrast, the present case requires assign operational support, vulnerability response and eventual retirement responsibilities. B:For the separate situation in which an agile development team interprets frequent deployments as permission to skip change documentation, rapid iteration can retain auditability and risk-based control without heavy manual handoffs; here the stated problem requires assign operational support, vulnerability response and eventual retirement responsibilities. D:Early security engagement reduces expensive architectural rework and overlooked abuse paths; although this helps when a product team adds security review only after a release candidate is built, it leaves the current case's need to assign operational support, vulnerability response and eventual retirement responsibilities unresolved.
Question 367 A system's release process allows developers to bypass required approvals by editing pipeline configuration. What design change is needed? Include automated code, dependency and policy checks as release gates with governed exceptions Document measurable security and privacy acceptance requirements with stakeholders Embed risk assessment and security requirements into early design and development gates Protect pipeline policy changes with independent review and restricted administrative rights Explanation Correct Answer D:Release governance depends on controlling the mechanism that enforces the gates. Incorrect Answers A:This option fits a different fact pattern where a DevOps pipeline promotes artifacts with no security checks because deadlines are tight: devSecOps shifts security verification into continuous delivery rather than post-release cleanup; the current case instead requires protect pipeline policy changes with independent review and restricted administrative rights. B:This option fits a different fact pattern where a new project selects a framework without defining security acceptance criteria: requirements must be testable before implementation can be meaningfully validated; the current case instead requires protect pipeline policy changes with independent review and restricted administrative rights. C:For the separate situation in which a product team adds security review only after a release candidate is built, early security engagement reduces expensive architectural rework and overlooked abuse paths; here the stated problem requires protect pipeline policy changes with independent review and restricted administrative rights.
Question 368 A development team plans a major data schema migration but no recovery or rollback strategy. What should design review require? Document measurable security and privacy acceptance requirements with stakeholders Protect pipeline policy changes with independent review and restricted administrative rights Define backward-compatible rollout and tested recovery paths before migration Embed risk assessment and security requirements into early design and development gates Explanation Correct Answer C:Database changes can cause irreversible operational impacts without explicit transition planning. Incorrect Answers A:Requirements must be testable before implementation can be meaningfully validated; although this helps when a new project selects a framework without defining security acceptance criteria, it leaves the current case's need to define backward-compatible rollout and tested recovery paths before migration unresolved. B:The other scenario states that a system's release process allows developers to bypass required approvals by editing pipeline configuration, where release governance depends on controlling the mechanism that enforces the gates; by contrast, the present case requires define backward-compatible rollout and tested recovery paths before migration. D:Early security engagement reduces expensive architectural rework and overlooked abuse paths; although this helps when a product team adds security review only after a release candidate is built, it leaves the current case's need to define backward-compatible rollout and tested recovery paths before migration unresolved.
Question 369 A build server downloads dependencies without checking package signatures or origin. What control is most relevant? Use static code analysis with appropriate data-flow rules Conduct authorized dynamic application tests against running endpoints Use instrumented interactive application security testing where appropriate Validate dependency provenance and integrity within a trusted build process Explanation Correct Answer D:Supply-chain compromise can enter the product before application testing starts. Incorrect Answers A:The other scenario states that a security engineer wants to find tainted input reaching dangerous SQL APIs without running the application, where sAST can inspect possible unsafe data paths without needing a live deployment; by contrast, the present case requires validate dependency provenance and integrity within a trusted build process. B:For the separate situation in which a web application may be vulnerable to authentication bypass after deployment, but source isn't available, dAST observes deployed behavior from interfaces even without source-code access; here the stated problem requires validate dependency provenance and integrity within a trusted build process. C:For the separate situation in which a company wants runtime feedback showing which tested lines and components create unsafe calls, iAST can combine runtime execution context with vulnerability observations; here the stated problem requires validate dependency provenance and integrity within a trusted build process.
Question 370 A Java application imports outdated components with known flaws. What testing should the CI pipeline add? Use instrumented interactive application security testing where appropriate Investigate build-chain integrity and block release pending provenance verification Use software composition analysis and verified dependency remediation Use scoped secrets management and isolation of privileged deployment stages Explanation Correct Answer C:SCA identifies risks in included packages that first-party static analysis may miss. Incorrect Answers A:The other scenario states that a company wants runtime feedback showing which tested lines and components create unsafe calls, where iAST can combine runtime execution context with vulnerability observations; by contrast, the present case requires use software composition analysis and verified dependency remediation. B:Unexpected artifact differences can indicate tampering or uncontrolled dependencies; it is relevant where a firmware build succeeds but its binary differs from the approved reproducible build output, whereas the current facts require use software composition analysis and verified dependency remediation to address the stated problem. D:This option fits a different fact pattern where a continuous delivery pipeline stores production credentials in unprotected environment variables visible to all jobs: cI workers should not expose persistent production credentials to untrusted build tasks; the current case instead requires use software composition analysis and verified dependency remediation.
