Exam Bundle

The BYOD device receives only authorized services and corporate management does not overreach personal data. This would be relevant evidence for a different failure: A remote contractor's personal device is provisioned as a managed corporate asset without separation, usually addressed by Apply BYOD onboarding and access policy with user consent and device-type restrictions. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: An unsponsored request cannot gain access and approved guest accounts expire as configured.

The test printer matches its intended profile and cannot receive privileged workstation access. This would be relevant evidence for a different failure: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled, usually addressed by Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: An unsponsored request cannot gain access and approved guest accounts expire as configured.

A noncompliant endpoint is placed in limited access until required controls pass. This would be relevant evidence for a different failure: Employees join a sensitive VLAN before their antivirus and patch compliance is established, usually addressed by Use identity and posture assessment to select compliant access or a remediation state. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: An unsponsored request cannot gain access and approved guest accounts expire as configured.

Use time-limited sponsor-approved guest identities and a separate guest authorization policy. That action fits another problem: A university provides guest Wi-Fi access using employee network credentials shared with visitors. It does not directly remediate the current finding at Evermere Health: A device changes ownership but remains categorized as its former high-trust endpoint type. The relevant corrective control for this case is: Refresh identity and profiling attributes and re-evaluate authorization when inventory changes.

Apply BYOD onboarding and access policy with user consent and device-type restrictions. That action fits another problem: A remote contractor's personal device is provisioned as a managed corporate asset without separation. It does not directly remediate the current finding at Evermere Health: A device changes ownership but remains categorized as its former high-trust endpoint type. The relevant corrective control for this case is: Refresh identity and profiling attributes and re-evaluate authorization when inventory changes.

Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type. That action fits another problem: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled. It does not directly remediate the current finding at Evermere Health: A device changes ownership but remains categorized as its former high-trust endpoint type. The relevant corrective control for this case is: Refresh identity and profiling attributes and re-evaluate authorization when inventory changes.

The test printer matches its intended profile and cannot receive privileged workstation access. This would be relevant evidence for a different failure: An ISE deployment cannot distinguish printers from managed laptops because device discovery is disabled, usually addressed by Use endpoint profiling from supported attributes and apply appropriately reviewed policy for each device type. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: The reclassified device loses its old access privilege and receives the new policy.

The BYOD device receives only authorized services and corporate management does not overreach personal data. This would be relevant evidence for a different failure: A remote contractor's personal device is provisioned as a managed corporate asset without separation, usually addressed by Apply BYOD onboarding and access policy with user consent and device-type restrictions. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: The reclassified device loses its old access privilege and receives the new policy.

Guests receive only guest network privileges and employee credentials remain individual. This would be relevant evidence for a different failure: A university provides guest Wi-Fi access using employee network credentials shared with visitors, usually addressed by Use time-limited sponsor-approved guest identities and a separate guest authorization policy. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: The reclassified device loses its old access privilege and receives the new policy.

Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. That action fits another problem: Guest account sponsorship allows any external user to self-approve long-lived privileged access. It does not directly remediate the current finding at Brightstone Legal: A device changes ownership but remains categorized as its former high-trust endpoint type. The relevant corrective control for this case is: Refresh identity and profiling attributes and re-evaluate authorization when inventory changes.

Use identity and posture assessment to select compliant access or a remediation state. That action fits another problem: Employees join a sensitive VLAN before their antivirus and patch compliance is established. It does not directly remediate the current finding at Brightstone Legal: A device changes ownership but remains categorized as its former high-trust endpoint type. The relevant corrective control for this case is: Refresh identity and profiling attributes and re-evaluate authorization when inventory changes.

Apply BYOD onboarding and access policy with user consent and device-type restrictions. That action fits another problem: A remote contractor's personal device is provisioned as a managed corporate asset without separation. It does not directly remediate the current finding at Brightstone Legal: A device changes ownership but remains categorized as its former high-trust endpoint type. The relevant corrective control for this case is: Refresh identity and profiling attributes and re-evaluate authorization when inventory changes.

A noncompliant endpoint is placed in limited access until required controls pass. This would be relevant evidence for a different failure: Employees join a sensitive VLAN before their antivirus and patch compliance is established, usually addressed by Use identity and posture assessment to select compliant access or a remediation state. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: The reclassified device loses its old access privilege and receives the new policy.

An unsponsored request cannot gain access and approved guest accounts expire as configured. This would be relevant evidence for a different failure: Guest account sponsorship allows any external user to self-approve long-lived privileged access, usually addressed by Require a verified sponsor and scoped guest lifecycle policy with automatic expiry. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: The reclassified device loses its old access privilege and receives the new policy.

The BYOD device receives only authorized services and corporate management does not overreach personal data. This would be relevant evidence for a different failure: A remote contractor's personal device is provisioned as a managed corporate asset without separation, usually addressed by Apply BYOD onboarding and access policy with user consent and device-type restrictions. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: The reclassified device loses its old access privilege and receives the new policy.

Check the freshness of posture signals and fail safely or provide limited remediation access. That action fits another problem: A device policy marks a host compliant even though required endpoint protection telemetry is stale. It does not directly remediate the current finding at Vantage Travel: Unmanaged devices have an operating system below the required supported version yet continue connecting to protected services. The relevant corrective control for this case is: Enforce device compliance policy for supported version and remediation requirements.

Use endpoint application discovery and risk-based allow or deny controls. That action fits another problem: Application inventory omits locally installed remote-control software used by third parties. It does not directly remediate the current finding at Vantage Travel: Unmanaged devices have an operating system below the required supported version yet continue connecting to protected services. The relevant corrective control for this case is: Enforce device compliance policy for supported version and remediation requirements.

Require verified device encryption and applicable baseline settings before sensitive data access. That action fits another problem: Mobile phones lacking encryption still receive confidential mail because enrollment alone is treated as compliance. It does not directly remediate the current finding at Vantage Travel: Unmanaged devices have an operating system below the required supported version yet continue connecting to protected services. The relevant corrective control for this case is: Enforce device compliance policy for supported version and remediation requirements.

The stale host does not gain full access until a recent successful assessment appears. This would be relevant evidence for a different failure: A device policy marks a host compliant even though required endpoint protection telemetry is stale, usually addressed by Check the freshness of posture signals and fail safely or provide limited remediation access. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An outdated device is restricted and becomes compliant only after verified update.

An unencrypted device is denied protected mail while an encrypted compliant phone succeeds. This would be relevant evidence for a different failure: Mobile phones lacking encryption still receive confidential mail because enrollment alone is treated as compliance, usually addressed by Require verified device encryption and applicable baseline settings before sensitive data access. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An outdated device is restricted and becomes compliant only after verified update.

Unauthorized remote-control tools are identified and prevented according to policy. This would be relevant evidence for a different failure: Application inventory omits locally installed remote-control software used by third parties, usually addressed by Use endpoint application discovery and risk-based allow or deny controls. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An outdated device is restricted and becomes compliant only after verified update.

Apply suitable application control or conditional policy to disallowed software behavior. That action fits another problem: An enterprise allows risky browser extensions to control business SaaS sessions without application governance. It does not directly remediate the current finding at Evergreen Hospital: Unmanaged devices have an operating system below the required supported version yet continue connecting to protected services. The relevant corrective control for this case is: Enforce device compliance policy for supported version and remediation requirements.

Use controlled application exceptions based on verified publisher, users, and business need. That action fits another problem: One restrictive policy disables a legitimate accessibility application across all endpoints. It does not directly remediate the current finding at Evergreen Hospital: Unmanaged devices have an operating system below the required supported version yet continue connecting to protected services. The relevant corrective control for this case is: Enforce device compliance policy for supported version and remediation requirements.

Check the freshness of posture signals and fail safely or provide limited remediation access. That action fits another problem: A device policy marks a host compliant even though required endpoint protection telemetry is stale. It does not directly remediate the current finding at Evergreen Hospital: Unmanaged devices have an operating system below the required supported version yet continue connecting to protected services. The relevant corrective control for this case is: Enforce device compliance policy for supported version and remediation requirements.

The authorized application is allowed for approved users without opening a fleetwide bypass. This would be relevant evidence for a different failure: One restrictive policy disables a legitimate accessibility application across all endpoints, usually addressed by Use controlled application exceptions based on verified publisher, users, and business need. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: An outdated device is restricted and becomes compliant only after verified update.

The stale host does not gain full access until a recent successful assessment appears. This would be relevant evidence for a different failure: A device policy marks a host compliant even though required endpoint protection telemetry is stale, usually addressed by Check the freshness of posture signals and fail safely or provide limited remediation access. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: An outdated device is restricted and becomes compliant only after verified update.

A prohibited extension is blocked or the session is restricted while approved browsers work. This would be relevant evidence for a different failure: An enterprise allows risky browser extensions to control business SaaS sessions without application governance, usually addressed by Apply suitable application control or conditional policy to disallowed software behavior. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: An outdated device is restricted and becomes compliant only after verified update.

Use controlled application exceptions based on verified publisher, users, and business need. That action fits another problem: One restrictive policy disables a legitimate accessibility application across all endpoints. It does not directly remediate the current finding at Aspen Digital: An enterprise allows risky browser extensions to control business SaaS sessions without application governance. The relevant corrective control for this case is: Apply suitable application control or conditional policy to disallowed software behavior.

Use endpoint application discovery and risk-based allow or deny controls. That action fits another problem: Application inventory omits locally installed remote-control software used by third parties. It does not directly remediate the current finding at Aspen Digital: An enterprise allows risky browser extensions to control business SaaS sessions without application governance. The relevant corrective control for this case is: Apply suitable application control or conditional policy to disallowed software behavior.

Check the freshness of posture signals and fail safely or provide limited remediation access. That action fits another problem: A device policy marks a host compliant even though required endpoint protection telemetry is stale. It does not directly remediate the current finding at Aspen Digital: An enterprise allows risky browser extensions to control business SaaS sessions without application governance. The relevant corrective control for this case is: Apply suitable application control or conditional policy to disallowed software behavior.

The stale host does not gain full access until a recent successful assessment appears. This would be relevant evidence for a different failure: A device policy marks a host compliant even though required endpoint protection telemetry is stale, usually addressed by Check the freshness of posture signals and fail safely or provide limited remediation access. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A prohibited extension is blocked or the session is restricted while approved browsers work.

Unauthorized remote-control tools are identified and prevented according to policy. This would be relevant evidence for a different failure: Application inventory omits locally installed remote-control software used by third parties, usually addressed by Use endpoint application discovery and risk-based allow or deny controls. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A prohibited extension is blocked or the session is restricted while approved browsers work.

The authorized application is allowed for approved users without opening a fleetwide bypass. This would be relevant evidence for a different failure: One restrictive policy disables a legitimate accessibility application across all endpoints, usually addressed by Use controlled application exceptions based on verified publisher, users, and business need. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A prohibited extension is blocked or the session is restricted while approved browsers work.