Question 70 An acquired company's customer database has unknown sensitivity markings. What should integration planning do? Have the data owner classify each dataset by sensitivity and impact of disclosure Classify model artifacts according to their business sensitivity and misuse impact Perform classification and ownership reconciliation before broad cross-company access Require the accountable data owner to assess and authorize reclassification Explanation Correct Answer C:Unverified legacy labels should not be assumed equivalent to the acquiring organization's scheme. Incorrect Answers A:Classification establishes protection requirements before implementing particular tools; it is relevant where a research lab stores genome records and public brochures in the same repository, whereas the current facts require perform classification and ownership reconciliation before broad cross-company access to address the stated problem. B:This option fits a different fact pattern where a model vendor calls training weights 'non-data' and proposes public storage despite trade-secret value: model weights can be valuable protected assets independent of personal-data content; the current case instead requires perform classification and ownership reconciliation before broad cross-company access. D:This option fits a different fact pattern where a project manager wants to lower a dataset's classification for convenience: classification decisions are based on business sensitivity and delegated data ownership; the current case instead requires perform classification and ownership reconciliation before broad cross-company access.
Question 71 A model vendor calls training weights 'non-data' and proposes public storage despite trade-secret value. What principle applies? Require the accountable data owner to assess and authorize reclassification Classify model artifacts according to their business sensitivity and misuse impact Inventory information types and processing paths to apply the appropriate labels Perform classification and ownership reconciliation before broad cross-company access Explanation Correct Answer B:Model weights can be valuable protected assets independent of personal-data content. Incorrect Answers A:This option fits a different fact pattern where a project manager wants to lower a dataset's classification for convenience: classification decisions are based on business sensitivity and delegated data ownership; the current case instead requires classify model artifacts according to their business sensitivity and misuse impact. C:Flow awareness determines where protective handling requirements follow the data; this responds to the different circumstance in which a team discovers that a system transmits highly sensitive reports but has no mapped data flows, while the current case states that a model vendor calls training weights 'non-data' and proposes public storage despite trade-secret value, calling for classify model artifacts according to their business sensitivity and misuse impact. D:Unverified legacy labels should not be assumed equivalent to the acquiring organization's scheme; although this helps when an acquired company's customer database has unknown sensitivity markings, it leaves the current case's need to classify model artifacts according to their business sensitivity and misuse impact unresolved.
Question 72 An analytics team sends classified records by email despite approved encrypted collaboration tools. What should policy specify? Define transmission channels, recipient checks and encryption based on classification Use documented custody, tamper-evident packaging and an authorized delivery process Require approved storage destinations and enforce device and transfer handling controls Use controlled printing, rapid retrieval and secure disposal of output Explanation Correct Answer A:Handling standards translate sensitivity labels into concrete sharing restrictions. Incorrect Answers B:This option fits a different fact pattern where an organization wants third-party couriers to transport confidential backup tapes: transfer and possession must be traceable through the entire physical handling chain; the current case instead requires define transmission channels, recipient checks and encryption based on classification. C:The other scenario states that operators frequently export client records to unencrypted personal drives, where protecting data requires controlling where copies can be created and stored; by contrast, the present case requires define transmission channels, recipient checks and encryption based on classification. D:The other scenario states that a sensitive report is printed on a shared floor printer and left unattended, where physical copies need protections equivalent to the classification of their information; by contrast, the present case requires define transmission channels, recipient checks and encryption based on classification.
Question 73 Operators frequently export client records to unencrypted personal drives. What control set is most appropriate? Define transmission channels, recipient checks and encryption based on classification Apply conservative interim restrictions and route uncertain classification to the owner Require approved storage destinations and enforce device and transfer handling controls Use controlled printing, rapid retrieval and secure disposal of output Explanation Correct Answer C:Protecting data requires controlling where copies can be created and stored. Incorrect Answers A:This option fits a different fact pattern where an analytics team sends classified records by email despite approved encrypted collaboration tools: handling standards translate sensitivity labels into concrete sharing restrictions; the current case instead requires require approved storage destinations and enforce device and transfer handling controls. B:For the separate situation in which security receives mislabeled support attachments from clients, uncertain classifications should not trigger uncontrolled disclosure during review; here the stated problem requires require approved storage destinations and enforce device and transfer handling controls. D:This option fits a different fact pattern where a sensitive report is printed on a shared floor printer and left unattended: physical copies need protections equivalent to the classification of their information; the current case instead requires require approved storage destinations and enforce device and transfer handling controls.
Question 74 A sensitive report is printed on a shared floor printer and left unattended. What should its handling standard require? Enforce authorized need-to-know access independent of the classification label Use controlled printing, rapid retrieval and secure disposal of output Require approved storage destinations and enforce device and transfer handling controls Use documented custody, tamper-evident packaging and an authorized delivery process Explanation Correct Answer B:Physical copies need protections equivalent to the classification of their information. Incorrect Answers A:Labels communicate sensitivity but do not replace authorization decisions; it is relevant where a project uses the correct information label but shares files with every employee, whereas the current facts require use controlled printing, rapid retrieval and secure disposal of output to address the stated problem. C:For the separate situation in which operators frequently export client records to unencrypted personal drives, protecting data requires controlling where copies can be created and stored; here the stated problem requires use controlled printing, rapid retrieval and secure disposal of output. D:Transfer and possession must be traceable through the entire physical handling chain; although this helps when an organization wants third-party couriers to transport confidential backup tapes, it leaves the current case's need to use controlled printing, rapid retrieval and secure disposal of output unresolved.
Question 75 A project uses the correct information label but shares files with every employee. What requirement is still missing? Use controlled printing, rapid retrieval and secure disposal of output Apply conservative interim restrictions and route uncertain classification to the owner Enforce authorized need-to-know access independent of the classification label Require approved storage destinations and enforce device and transfer handling controls Explanation Correct Answer C:Labels communicate sensitivity but do not replace authorization decisions. Incorrect Answers A:For the separate situation in which a sensitive report is printed on a shared floor printer and left unattended, physical copies need protections equivalent to the classification of their information; here the stated problem requires enforce authorized need-to-know access independent of the classification label. B:Uncertain classifications should not trigger uncontrolled disclosure during review; this responds to the different circumstance in which security receives mislabeled support attachments from clients, while the current case states that a project uses the correct information label but shares files with every employee, calling for enforce authorized need-to-know access independent of the classification label. D:The other scenario states that operators frequently export client records to unencrypted personal drives, where protecting data requires controlling where copies can be created and stored; by contrast, the present case requires enforce authorized need-to-know access independent of the classification label.
Question 76 Security receives mislabeled support attachments from clients. How should the intake process handle them? Use documented custody, tamper-evident packaging and an authorized delivery process Use controlled printing, rapid retrieval and secure disposal of output Define transmission channels, recipient checks and encryption based on classification Apply conservative interim restrictions and route uncertain classification to the owner Explanation Correct Answer D:Uncertain classifications should not trigger uncontrolled disclosure during review. Incorrect Answers A:Transfer and possession must be traceable through the entire physical handling chain; although this helps when an organization wants third-party couriers to transport confidential backup tapes, it leaves the current case's need to apply conservative interim restrictions and route uncertain classification to the owner unresolved. B:Physical copies need protections equivalent to the classification of their information; it is relevant where a sensitive report is printed on a shared floor printer and left unattended, whereas the current facts require apply conservative interim restrictions and route uncertain classification to the owner to address the stated problem. C:Handling standards translate sensitivity labels into concrete sharing restrictions; it is relevant where an analytics team sends classified records by email despite approved encrypted collaboration tools, whereas the current facts require apply conservative interim restrictions and route uncertain classification to the owner to address the stated problem.
Question 77 An organization wants third-party couriers to transport confidential backup tapes. What is needed? Use documented custody, tamper-evident packaging and an authorized delivery process Use controlled printing, rapid retrieval and secure disposal of output Apply conservative interim restrictions and route uncertain classification to the owner Require approved storage destinations and enforce device and transfer handling controls Explanation Correct Answer A:Transfer and possession must be traceable through the entire physical handling chain. Incorrect Answers B:This option fits a different fact pattern where a sensitive report is printed on a shared floor printer and left unattended: physical copies need protections equivalent to the classification of their information; the current case instead requires use documented custody, tamper-evident packaging and an authorized delivery process. C:This option fits a different fact pattern where security receives mislabeled support attachments from clients: uncertain classifications should not trigger uncontrolled disclosure during review; the current case instead requires use documented custody, tamper-evident packaging and an authorized delivery process. D:For the separate situation in which operators frequently export client records to unencrypted personal drives, protecting data requires controlling where copies can be created and stored; here the stated problem requires use documented custody, tamper-evident packaging and an authorized delivery process.
Question 78 A new SaaS application is provisioned without a business owner or lifecycle record. What should asset governance establish? Inventory and govern image artifacts and registries as software assets Enforce ownership metadata at provisioning and periodically reconcile exceptions Register the service, accountable owner, purpose and approved configuration baseline Verify provenance, secure baseline and asset registration before connecting it to production Explanation Correct Answer C:Provisioning must create inventory and ownership information for future risk management. Incorrect Answers A:For the separate situation in which an engineer insists container images cannot be tracked as assets because they are transient, short-lived runtime instances do not eliminate the persistent risk in deployed artifacts; here the stated problem requires register the service, accountable owner, purpose and approved configuration baseline. B:Owner attribution supports accountability and response when cloud assets change rapidly; although this helps when a cloud account contains untagged workloads whose owners cannot be identified, it leaves the current case's need to register the service, accountable owner, purpose and approved configuration baseline unresolved. D:Onboarding unverified hardware can introduce compromised firmware or insecure settings; this responds to the different circumstance in which a supplier replaces a network appliance with an unknown preconfigured device, while the current case states that a new SaaS application is provisioned without a business owner or lifecycle record, calling for register the service, accountable owner, purpose and approved configuration baseline.
Question 79 Several decommissioned laptops remain listed as active inventory. What improvement is required? Verify managed configuration and encryption against a standard before user handoff Verify provenance, secure baseline and asset registration before connecting it to production Require approved environments and recorded authorization before deploying sensitive data copies Integrate acquisition, reassignment and retirement events with inventory reconciliation Explanation Correct Answer D:Asset records should reflect actual custody and lifecycle, not only purchases. Incorrect Answers A:For the separate situation in which a remote-work team issues devices without confirming encryption before shipment, secure provisioning checks protective state prior to exposing the device to uncontrolled locations; here the stated problem requires integrate acquisition, reassignment and retirement events with inventory reconciliation. B:Onboarding unverified hardware can introduce compromised firmware or insecure settings; this responds to the different circumstance in which a supplier replaces a network appliance with an unknown preconfigured device, while the current case states that several decommissioned laptops remain listed as active inventory, calling for integrate acquisition, reassignment and retirement events with inventory reconciliation. C:Asset protection must apply when information is created or provisioned into new contexts; this responds to the different circumstance in which a training dataset is copied into an unapproved testing tenant, while the current case states that several decommissioned laptops remain listed as active inventory, calling for integrate acquisition, reassignment and retirement events with inventory reconciliation.
Question 80 A remote-work team issues devices without confirming encryption before shipment. What control belongs in provisioning? Verify provenance, secure baseline and asset registration before connecting it to production Enforce ownership metadata at provisioning and periodically reconcile exceptions Require approved environments and recorded authorization before deploying sensitive data copies Verify managed configuration and encryption against a standard before user handoff Explanation Correct Answer D:Secure provisioning checks protective state prior to exposing the device to uncontrolled locations. Incorrect Answers A:This option fits a different fact pattern where a supplier replaces a network appliance with an unknown preconfigured device: onboarding unverified hardware can introduce compromised firmware or insecure settings; the current case instead requires verify managed configuration and encryption against a standard before user handoff. B:The other scenario states that a cloud account contains untagged workloads whose owners cannot be identified, where owner attribution supports accountability and response when cloud assets change rapidly; by contrast, the present case requires verify managed configuration and encryption against a standard before user handoff. C:The other scenario states that a training dataset is copied into an unapproved testing tenant, where asset protection must apply when information is created or provisioned into new contexts; by contrast, the present case requires verify managed configuration and encryption against a standard before user handoff.
