Exam Bundle

Legitimate notices deliver and impersonation tests still trigger review. This would be relevant evidence for a different failure: An executive-impersonation rule blocks legitimate internal bulk notices because sender policy matching is too broad, usually addressed by Tune identity, sender domain, and authentication conditions with controlled exceptions. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A controlled malicious message to the new domain generates the configured detection.

A malicious-link test message is flagged without blocking safe business mail. This would be relevant evidence for a different failure: Inbound email policy filters attachments by filename only and misses malicious links in message bodies, usually addressed by Enable appropriate threat analysis and URL protection policies on targeted mail flows. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A controlled malicious message to the new domain generates the configured detection.

A simulated post-delivery threat is identified and remediated from affected mailboxes. This would be relevant evidence for a different failure: Security email tooling detects suspicious messages but admins have no process to remove copies already delivered, usually addressed by Configure approved mailbox remediation or quarantine workflows and incident ownership. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A controlled malicious message to the new domain generates the configured detection.

Apply BYOD onboarding and access policy with user consent and device-type restrictions. That action fits another problem: A remote contractor's personal device is provisioned as a managed corporate asset without separation. It does not directly remediate the current finding at Trident Finance: A university provides guest Wi-Fi access using employee network credentials shared with visitors. The relevant corrective control for this case is: Use time-limited sponsor-approved guest identities and a separate guest authorization policy.

Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type. That action fits another problem: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. It does not directly remediate the current finding at Trident Finance: A university provides guest Wi-Fi access using employee network credentials shared with visitors. The relevant corrective control for this case is: Use time-limited sponsor-approved guest identities and a separate guest authorization policy.

Use identity and posture assessment to select compliant access or a remediation state. That action fits another problem: Employees join a sensitive VLAN before their antivirus and patch compliance is established. It does not directly remediate the current finding at Trident Finance: A university provides guest Wi-Fi access using employee network credentials shared with visitors. The relevant corrective control for this case is: Use time-limited sponsor-approved guest identities and a separate guest authorization policy.

The BYOD device receives only authorized services and corporate management does not overreach personal data. This would be relevant evidence for a different failure: A remote contractor's personal device is provisioned as a managed corporate asset without separation, usually addressed by Apply BYOD onboarding and access policy with user consent and device-type restrictions. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: Guests receive only guest network privileges and employee credentials remain individual.

The test printer matches its intended profile and cannot receive privileged workstation access. This would be relevant evidence for a different failure: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled, usually addressed by Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: Guests receive only guest network privileges and employee credentials remain individual.

A noncompliant endpoint is placed in limited access until required controls pass. This would be relevant evidence for a different failure: Employees join a sensitive VLAN before their antivirus and patch compliance is established, usually addressed by Use identity and posture assessment to select compliant access or a remediation state. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: Guests receive only guest network privileges and employee credentials remain individual.

Refresh identity and profiling attributes and re-evaluate authorization when inventory changes. That action fits another problem: A device changes ownership but remains categorized as its former high-trust endpoint type. It does not directly remediate the current finding at Seabright Municipal Works: A university provides guest Wi-Fi access using employee network credentials shared with visitors. The relevant corrective control for this case is: Use time-limited sponsor-approved guest identities and a separate guest authorization policy.

Use identity and posture assessment to select compliant access or a remediation state. That action fits another problem: Employees join a sensitive VLAN before their antivirus and patch compliance is established. It does not directly remediate the current finding at Seabright Municipal Works: A university provides guest Wi-Fi access using employee network credentials shared with visitors. The relevant corrective control for this case is: Use time-limited sponsor-approved guest identities and a separate guest authorization policy.

Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. That action fits another problem: Guest account sponsorship allows any external user to self-approve long-lived privileged access. It does not directly remediate the current finding at Seabright Municipal Works: A university provides guest Wi-Fi access using employee network credentials shared with visitors. The relevant corrective control for this case is: Use time-limited sponsor-approved guest identities and a separate guest authorization policy.

An unsponsored request cannot gain access and approved guest accounts expire as configured. This would be relevant evidence for a different failure: Guest account sponsorship allows any external user to self-approve long-lived privileged access, usually addressed by Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: Guests receive only guest network privileges and employee credentials remain individual.

The reclassified device loses its old access privilege and receives the new policy. This would be relevant evidence for a different failure: A device changes ownership but remains categorized as its former high-trust endpoint type, usually addressed by Refresh identity and profiling attributes and re-evaluate authorization when inventory changes. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: Guests receive only guest network privileges and employee credentials remain individual.

A noncompliant endpoint is placed in limited access until required controls pass. This would be relevant evidence for a different failure: Employees join a sensitive VLAN before their antivirus and patch compliance is established, usually addressed by Use identity and posture assessment to select compliant access or a remediation state. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: Guests receive only guest network privileges and employee credentials remain individual.

Apply BYOD onboarding and access policy with user consent and device-type restrictions. That action fits another problem: A remote contractor's personal device is provisioned as a managed corporate asset without separation. It does not directly remediate the current finding at Prairie Health Network: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. The relevant corrective control for this case is: Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type.

Use identity and posture assessment to select compliant access or a remediation state. That action fits another problem: Employees join a sensitive VLAN before their antivirus and patch compliance is established. It does not directly remediate the current finding at Prairie Health Network: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. The relevant corrective control for this case is: Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type.

Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. That action fits another problem: Guest account sponsorship allows any external user to self-approve long-lived privileged access. It does not directly remediate the current finding at Prairie Health Network: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. The relevant corrective control for this case is: Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type.

A noncompliant endpoint is placed in limited access until required controls pass. This would be relevant evidence for a different failure: Employees join a sensitive VLAN before their antivirus and patch compliance is established, usually addressed by Use identity and posture assessment to select compliant access or a remediation state. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: The test printer matches its intended profile and cannot receive privileged workstation access.

An unsponsored request cannot gain access and approved guest accounts expire as configured. This would be relevant evidence for a different failure: Guest account sponsorship allows any external user to self-approve long-lived privileged access, usually addressed by Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: The test printer matches its intended profile and cannot receive privileged workstation access.

The BYOD device receives only authorized services and corporate management does not overreach personal data. This would be relevant evidence for a different failure: A remote contractor's personal device is provisioned as a managed corporate asset without separation, usually addressed by Apply BYOD onboarding and access policy with user consent and device-type restrictions. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: The test printer matches its intended profile and cannot receive privileged workstation access.

Refresh identity and profiling attributes and re-evaluate authorization when inventory changes. That action fits another problem: A device changes ownership but remains categorized as its former high-trust endpoint type. It does not directly remediate the current finding at Boreal Foods: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. The relevant corrective control for this case is: Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type.

Use time-limited sponsor-approved guest identities and a separate guest authorization policy. That action fits another problem: A university provides guest Wi-Fi access using employee network credentials shared with visitors. It does not directly remediate the current finding at Boreal Foods: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. The relevant corrective control for this case is: Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type.

Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. That action fits another problem: Guest account sponsorship allows any external user to self-approve long-lived privileged access. It does not directly remediate the current finding at Boreal Foods: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. The relevant corrective control for this case is: Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type.

Guests receive only guest network privileges and employee credentials remain individual. This would be relevant evidence for a different failure: A university provides guest Wi-Fi access using employee network credentials shared with visitors, usually addressed by Use time-limited sponsor-approved guest identities and a separate guest authorization policy. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: The test printer matches its intended profile and cannot receive privileged workstation access.

The reclassified device loses its old access privilege and receives the new policy. This would be relevant evidence for a different failure: A device changes ownership but remains categorized as its former high-trust endpoint type, usually addressed by Refresh identity and profiling attributes and re-evaluate authorization when inventory changes. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: The test printer matches its intended profile and cannot receive privileged workstation access.

An unsponsored request cannot gain access and approved guest accounts expire as configured. This would be relevant evidence for a different failure: Guest account sponsorship allows any external user to self-approve long-lived privileged access, usually addressed by Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: The test printer matches its intended profile and cannot receive privileged workstation access.

Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. That action fits another problem: Guest account sponsorship allows any external user to self-approve long-lived privileged access. It does not directly remediate the current finding at Willowbrook Education: A remote contractor's personal device is provisioned as a managed corporate asset without separation. The relevant corrective control for this case is: Apply BYOD onboarding and access policy with user consent and device-type restrictions.

Refresh identity and profiling attributes and re-evaluate authorization when inventory changes. That action fits another problem: A device changes ownership but remains categorized as its former high-trust endpoint type. It does not directly remediate the current finding at Willowbrook Education: A remote contractor's personal device is provisioned as a managed corporate asset without separation. The relevant corrective control for this case is: Apply BYOD onboarding and access policy with user consent and device-type restrictions.

Use identity and posture assessment to select compliant access or a remediation state. That action fits another problem: Employees join a sensitive VLAN before their antivirus and patch compliance is established. It does not directly remediate the current finding at Willowbrook Education: A remote contractor's personal device is provisioned as a managed corporate asset without separation. The relevant corrective control for this case is: Apply BYOD onboarding and access policy with user consent and device-type restrictions.

An unsponsored request cannot gain access and approved guest accounts expire as configured. This would be relevant evidence for a different failure: Guest account sponsorship allows any external user to self-approve long-lived privileged access, usually addressed by Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The BYOD device receives only authorized services and corporate management does not overreach personal data.

A noncompliant endpoint is placed in limited access until required controls pass. This would be relevant evidence for a different failure: Employees join a sensitive VLAN before their antivirus and patch compliance is established, usually addressed by Use identity and posture assessment to select compliant access or a remediation state. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The BYOD device receives only authorized services and corporate management does not overreach personal data.

The reclassified device loses its old access privilege and receives the new policy. This would be relevant evidence for a different failure: A device changes ownership but remains categorized as its former high-trust endpoint type, usually addressed by Refresh identity and profiling attributes and re-evaluate authorization when inventory changes. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The BYOD device receives only authorized services and corporate management does not overreach personal data.