Question 80 A remote-work team issues devices without confirming encryption before shipment. What control belongs in provisioning? Verify provenance, secure baseline and asset registration before connecting it to production Enforce ownership metadata at provisioning and periodically reconcile exceptions Require approved environments and recorded authorization before deploying sensitive data copies Verify managed configuration and encryption against a standard before user handoff Explanation Correct Answer D:Secure provisioning checks protective state prior to exposing the device to uncontrolled locations. Incorrect Answers A:This option fits a different fact pattern where a supplier replaces a network appliance with an unknown preconfigured device: onboarding unverified hardware can introduce compromised firmware or insecure settings; the current case instead requires verify managed configuration and encryption against a standard before user handoff. B:The other scenario states that a cloud account contains untagged workloads whose owners cannot be identified, where owner attribution supports accountability and response when cloud assets change rapidly; by contrast, the present case requires verify managed configuration and encryption against a standard before user handoff. C:The other scenario states that a training dataset is copied into an unapproved testing tenant, where asset protection must apply when information is created or provisioned into new contexts; by contrast, the present case requires verify managed configuration and encryption against a standard before user handoff.
Question 81 A cloud account contains untagged workloads whose owners cannot be identified. What should the organization implement? Verify provenance, secure baseline and asset registration before connecting it to production Inventory and govern image artifacts and registries as software assets Verify managed configuration and encryption against a standard before user handoff Enforce ownership metadata at provisioning and periodically reconcile exceptions Explanation Correct Answer D:Owner attribution supports accountability and response when cloud assets change rapidly. Incorrect Answers A:The other scenario states that a supplier replaces a network appliance with an unknown preconfigured device, where onboarding unverified hardware can introduce compromised firmware or insecure settings; by contrast, the present case requires enforce ownership metadata at provisioning and periodically reconcile exceptions. B:For the separate situation in which an engineer insists container images cannot be tracked as assets because they are transient, short-lived runtime instances do not eliminate the persistent risk in deployed artifacts; here the stated problem requires enforce ownership metadata at provisioning and periodically reconcile exceptions. C:Secure provisioning checks protective state prior to exposing the device to uncontrolled locations; although this helps when a remote-work team issues devices without confirming encryption before shipment, it leaves the current case's need to enforce ownership metadata at provisioning and periodically reconcile exceptions unresolved.
Question 82 A training dataset is copied into an unapproved testing tenant. What provision process failed? Verify provenance, secure baseline and asset registration before connecting it to production Inventory and govern image artifacts and registries as software assets Integrate acquisition, reassignment and retirement events with inventory reconciliation Require approved environments and recorded authorization before deploying sensitive data copies Explanation Correct Answer D:Asset protection must apply when information is created or provisioned into new contexts. Incorrect Answers A:This option fits a different fact pattern where a supplier replaces a network appliance with an unknown preconfigured device: onboarding unverified hardware can introduce compromised firmware or insecure settings; the current case instead requires require approved environments and recorded authorization before deploying sensitive data copies. B:The other scenario states that an engineer insists container images cannot be tracked as assets because they are transient, where short-lived runtime instances do not eliminate the persistent risk in deployed artifacts; by contrast, the present case requires require approved environments and recorded authorization before deploying sensitive data copies. C:For the separate situation in which several decommissioned laptops remain listed as active inventory, asset records should reflect actual custody and lifecycle, not only purchases; here the stated problem requires require approved environments and recorded authorization before deploying sensitive data copies.
Question 83 A supplier replaces a network appliance with an unknown preconfigured device. What should receiving procedures demand? Inventory and govern image artifacts and registries as software assets Verify provenance, secure baseline and asset registration before connecting it to production Integrate acquisition, reassignment and retirement events with inventory reconciliation Enforce ownership metadata at provisioning and periodically reconcile exceptions Explanation Correct Answer B:Onboarding unverified hardware can introduce compromised firmware or insecure settings. Incorrect Answers A:This option fits a different fact pattern where an engineer insists container images cannot be tracked as assets because they are transient: short-lived runtime instances do not eliminate the persistent risk in deployed artifacts; the current case instead requires verify provenance, secure baseline and asset registration before connecting it to production. C:Asset records should reflect actual custody and lifecycle, not only purchases; this responds to the different circumstance in which several decommissioned laptops remain listed as active inventory, while the current case states that a supplier replaces a network appliance with an unknown preconfigured device, calling for verify provenance, secure baseline and asset registration before connecting it to production. D:This option fits a different fact pattern where a cloud account contains untagged workloads whose owners cannot be identified: owner attribution supports accountability and response when cloud assets change rapidly; the current case instead requires verify provenance, secure baseline and asset registration before connecting it to production.
Question 84 An engineer insists container images cannot be tracked as assets because they are transient. What should the CISO require? Register the service, accountable owner, purpose and approved configuration baseline Verify provenance, secure baseline and asset registration before connecting it to production Integrate acquisition, reassignment and retirement events with inventory reconciliation Inventory and govern image artifacts and registries as software assets Explanation Correct Answer D:Short-lived runtime instances do not eliminate the persistent risk in deployed artifacts. Incorrect Answers A:Provisioning must create inventory and ownership information for future risk management; it is relevant where a new SaaS application is provisioned without a business owner or lifecycle record, whereas the current facts require inventory and govern image artifacts and registries as software assets to address the stated problem. B:Onboarding unverified hardware can introduce compromised firmware or insecure settings; although this helps when a supplier replaces a network appliance with an unknown preconfigured device, it leaves the current case's need to inventory and govern image artifacts and registries as software assets unresolved. C:This option fits a different fact pattern where several decommissioned laptops remain listed as active inventory: asset records should reflect actual custody and lifecycle, not only purchases; the current case instead requires inventory and govern image artifacts and registries as software assets.
Question 85 A hospital plans to retain all patient diagnostic logs indefinitely 'in case they are useful'. What lifecycle control is missing? Map primary and replicated copies and manage deletion according to retention and restoration constraints Set purpose- and obligation-based retention and disposal rules approved by data owners Minimize collection and promptly dispose of raw images after required verification and retention periods Keep sanitization method, verification result, custody and disposal records Explanation Correct Answer B:Data minimization and retention discipline reduce unnecessary exposure and comply with applicable duties. Incorrect Answers A:This option fits a different fact pattern where a company deletes cloud objects but retains unmanaged replicas in backups: a deletion request may leave additional recoverable copies unless the entire data lifecycle is considered; the current case instead requires set purpose- and obligation-based retention and disposal rules approved by data owners. C:This option fits a different fact pattern where a service needs raw identification images only to verify accounts at signup: keeping unnecessary identity evidence creates avoidable privacy and breach risk; the current case instead requires set purpose- and obligation-based retention and disposal rules approved by data owners. D:Documented validation supports assurance that reuse or destruction was appropriate for sensitivity; this responds to the different circumstance in which a manufacturer must prove discarded media no longer exposes a design secret, while the current case states that a hospital plans to retain all patient diagnostic logs indefinitely 'in case they are useful', calling for set purpose- and obligation-based retention and disposal rules approved by data owners.
Question 86 A cloud vendor processes personal information under customer instruction. Which division of responsibility should be explicit? Map primary and replicated copies and manage deletion according to retention and restoration constraints Minimize collection and promptly dispose of raw images after required verification and retention periods Select and verify media sanitization under a risk-based program suitable for the device and data Distinguish controller decisions from processor obligations in the processing agreement Explanation Correct Answer D:Purpose determination and delegated processing are different responsibilities. Incorrect Answers A:A deletion request may leave additional recoverable copies unless the entire data lifecycle is considered; it is relevant where a company deletes cloud objects but retains unmanaged replicas in backups, whereas the current facts require distinguish controller decisions from processor obligations in the processing agreement to address the stated problem. B:Keeping unnecessary identity evidence creates avoidable privacy and breach risk; it is relevant where a service needs raw identification images only to verify accounts at signup, whereas the current facts require distinguish controller decisions from processor obligations in the processing agreement to address the stated problem. C:This option fits a different fact pattern where a solid-state drive containing classified data is being reused for a lower-sensitivity task: deletion of visible files alone is not reliable sanitization of underlying media; the current case instead requires distinguish controller decisions from processor obligations in the processing agreement.
Question 87 A service needs raw identification images only to verify accounts at signup. What design reduces long-term exposure? Set purpose- and obligation-based retention and disposal rules approved by data owners Identify the responsible data controller or equivalent governing party for processing purposes Keep sanitization method, verification result, custody and disposal records Minimize collection and promptly dispose of raw images after required verification and retention periods Explanation Correct Answer D:Keeping unnecessary identity evidence creates avoidable privacy and breach risk. Incorrect Answers A:Data minimization and retention discipline reduce unnecessary exposure and comply with applicable duties; although this helps when a hospital plans to retain all patient diagnostic logs indefinitely 'in case they are useful', it leaves the current case's need to minimize collection and promptly dispose of raw images after required verification and retention periods unresolved. B:Purpose and means decisions belong to the controlling organization under applicable arrangements; this responds to the different circumstance in which a consumer asks who decides why collected location data is used, while the current case states that a service needs raw identification images only to verify accounts at signup, calling for minimize collection and promptly dispose of raw images after required verification and retention periods. C:Documented validation supports assurance that reuse or destruction was appropriate for sensitivity; although this helps when a manufacturer must prove discarded media no longer exposes a design secret, it leaves the current case's need to minimize collection and promptly dispose of raw images after required verification and retention periods unresolved.
Question 88 A solid-state drive containing classified data is being reused for a lower-sensitivity task. What is appropriate? Select and verify media sanitization under a risk-based program suitable for the device and data Keep sanitization method, verification result, custody and disposal records Identify the responsible data controller or equivalent governing party for processing purposes Minimize collection and promptly dispose of raw images after required verification and retention periods Explanation Correct Answer A:Deletion of visible files alone is not reliable sanitization of underlying media. Incorrect Answers B:The other scenario states that a manufacturer must prove discarded media no longer exposes a design secret, where documented validation supports assurance that reuse or destruction was appropriate for sensitivity; by contrast, the present case requires select and verify media sanitization under a risk-based program suitable for the device and data. C:The other scenario states that a consumer asks who decides why collected location data is used, where purpose and means decisions belong to the controlling organization under applicable arrangements; by contrast, the present case requires select and verify media sanitization under a risk-based program suitable for the device and data. D:The other scenario states that a service needs raw identification images only to verify accounts at signup, where keeping unnecessary identity evidence creates avoidable privacy and breach risk; by contrast, the present case requires select and verify media sanitization under a risk-based program suitable for the device and data.
Question 89 Employees assume moving records to an archive means they no longer need access controls. What should be enforced? Select and verify media sanitization under a risk-based program suitable for the device and data Set purpose- and obligation-based retention and disposal rules approved by data owners Map primary and replicated copies and manage deletion according to retention and restoration constraints Keep classification, access and retention rules effective through archival and final disposal Explanation Correct Answer D:Lifecycle transitions do not remove confidentiality or integrity obligations. Incorrect Answers A:Deletion of visible files alone is not reliable sanitization of underlying media; it is relevant where a solid-state drive containing classified data is being reused for a lower-sensitivity task, whereas the current facts require keep classification, access and retention rules effective through archival and final disposal to address the stated problem. B:Data minimization and retention discipline reduce unnecessary exposure and comply with applicable duties; although this helps when a hospital plans to retain all patient diagnostic logs indefinitely 'in case they are useful', it leaves the current case's need to keep classification, access and retention rules effective through archival and final disposal unresolved. C:For the separate situation in which a company deletes cloud objects but retains unmanaged replicas in backups, a deletion request may leave additional recoverable copies unless the entire data lifecycle is considered; here the stated problem requires keep classification, access and retention rules effective through archival and final disposal.
Question 90 A company deletes cloud objects but retains unmanaged replicas in backups. What should disposal planning include? Map primary and replicated copies and manage deletion according to retention and restoration constraints Distinguish controller decisions from processor obligations in the processing agreement Keep sanitization method, verification result, custody and disposal records Keep classification, access and retention rules effective through archival and final disposal Explanation Correct Answer A:A deletion request may leave additional recoverable copies unless the entire data lifecycle is considered. Incorrect Answers B:The other scenario states that a cloud vendor processes personal information under customer instruction, where purpose determination and delegated processing are different responsibilities; by contrast, the present case requires map primary and replicated copies and manage deletion according to retention and restoration constraints. C:This option fits a different fact pattern where a manufacturer must prove discarded media no longer exposes a design secret: documented validation supports assurance that reuse or destruction was appropriate for sensitivity; the current case instead requires map primary and replicated copies and manage deletion according to retention and restoration constraints. D:For the separate situation in which employees assume moving records to an archive means they no longer need access controls, lifecycle transitions do not remove confidentiality or integrity obligations; here the stated problem requires map primary and replicated copies and manage deletion according to retention and restoration constraints.
