Exam Bundle

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A controlled tunneling simulation raises an event while routine DNS requests work.

The covert-transfer test creates an alert and cannot move meaningful protected data. This would be relevant evidence for a different failure: A malicious process attempts to leak data through ICMP payloads rather than common web ports, usually addressed by Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A controlled tunneling simulation raises an event while routine DNS requests work.

Unapproved outbound file-transfer traffic is denied and correlated with source activity. This would be relevant evidence for a different failure: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight, usually addressed by Apply egress controls and investigate host and flow telemetry for unauthorized transfer. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A controlled tunneling simulation raises an event while routine DNS requests work.

Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. That action fits another problem: A malicious process attempts to leak data through ICMP payloads rather than common web ports. It does not directly remediate the current finding at Northshore Hospitality: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. The relevant corrective control for this case is: Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules.

Apply egress controls and investigate host and flow telemetry for unauthorized transfer. That action fits another problem: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. It does not directly remediate the current finding at Northshore Hospitality: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. The relevant corrective control for this case is: Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules.

Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. That action fits another problem: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior. It does not directly remediate the current finding at Northshore Hospitality: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. The relevant corrective control for this case is: Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules.

Unapproved outbound file-transfer traffic is denied and correlated with source activity. This would be relevant evidence for a different failure: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight, usually addressed by Apply egress controls and investigate host and flow telemetry for unauthorized transfer. It does not demonstrate that the current problem at Northshore Hospitality was resolved. The specific required evidence is: The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues.

A controlled tunneling simulation raises an event while routine DNS requests work. This would be relevant evidence for a different failure: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior, usually addressed by Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. It does not demonstrate that the current problem at Northshore Hospitality was resolved. The specific required evidence is: The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues.

The covert-transfer test creates an alert and cannot move meaningful protected data. This would be relevant evidence for a different failure: A malicious process attempts to leak data through ICMP payloads rather than common web ports, usually addressed by Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. It does not demonstrate that the current problem at Northshore Hospitality was resolved. The specific required evidence is: The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues.

Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. That action fits another problem: A malicious process attempts to leak data through ICMP payloads rather than common web ports. It does not directly remediate the current finding at Willowbrook Education: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. The relevant corrective control for this case is: Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules.

Detect protocol-abuse deviations and restrict NTP to approved time sources. That action fits another problem: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. It does not directly remediate the current finding at Willowbrook Education: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. The relevant corrective control for this case is: Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules.

Use application-aware egress policy and DLP across approved and unapproved transfer channels. That action fits another problem: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. It does not directly remediate the current finding at Willowbrook Education: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. The relevant corrective control for this case is: Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules.

The covert-transfer test creates an alert and cannot move meaningful protected data. This would be relevant evidence for a different failure: A malicious process attempts to leak data through ICMP payloads rather than common web ports, usually addressed by Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues.

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues.

A protected data sample is stopped across relevant channels rather than just FTP. This would be relevant evidence for a different failure: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps, usually addressed by Use application-aware egress policy and DLP across approved and unapproved transfer channels. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues.

Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. That action fits another problem: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. It does not directly remediate the current finding at Silverline Labs: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. The relevant corrective control for this case is: Apply egress controls and investigate host and flow telemetry for unauthorized transfer.

Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. That action fits another problem: A malicious process attempts to leak data through ICMP payloads rather than common web ports. It does not directly remediate the current finding at Silverline Labs: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. The relevant corrective control for this case is: Apply egress controls and investigate host and flow telemetry for unauthorized transfer.

Detect protocol-abuse deviations and restrict NTP to approved time sources. That action fits another problem: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. It does not directly remediate the current finding at Silverline Labs: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. The relevant corrective control for this case is: Apply egress controls and investigate host and flow telemetry for unauthorized transfer.

The covert-transfer test creates an alert and cannot move meaningful protected data. This would be relevant evidence for a different failure: A malicious process attempts to leak data through ICMP payloads rather than common web ports, usually addressed by Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. It does not demonstrate that the current problem at Silverline Labs was resolved. The specific required evidence is: Unapproved outbound file-transfer traffic is denied and correlated with source activity.

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Silverline Labs was resolved. The specific required evidence is: Unapproved outbound file-transfer traffic is denied and correlated with source activity.

The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues. This would be relevant evidence for a different failure: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session, usually addressed by Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. It does not demonstrate that the current problem at Silverline Labs was resolved. The specific required evidence is: Unapproved outbound file-transfer traffic is denied and correlated with source activity.

Use application-aware egress policy and DLP across approved and unapproved transfer channels. That action fits another problem: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. It does not directly remediate the current finding at Westlake Retail: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. The relevant corrective control for this case is: Apply egress controls and investigate host and flow telemetry for unauthorized transfer.

Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. That action fits another problem: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior. It does not directly remediate the current finding at Westlake Retail: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. The relevant corrective control for this case is: Apply egress controls and investigate host and flow telemetry for unauthorized transfer.

Detect protocol-abuse deviations and restrict NTP to approved time sources. That action fits another problem: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. It does not directly remediate the current finding at Westlake Retail: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. The relevant corrective control for this case is: Apply egress controls and investigate host and flow telemetry for unauthorized transfer.

A protected data sample is stopped across relevant channels rather than just FTP. This would be relevant evidence for a different failure: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps, usually addressed by Use application-aware egress policy and DLP across approved and unapproved transfer channels. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Unapproved outbound file-transfer traffic is denied and correlated with source activity.

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Unapproved outbound file-transfer traffic is denied and correlated with source activity.

A controlled tunneling simulation raises an event while routine DNS requests work. This would be relevant evidence for a different failure: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior, usually addressed by Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Unapproved outbound file-transfer traffic is denied and correlated with source activity.

Apply egress controls and investigate host and flow telemetry for unauthorized transfer. That action fits another problem: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. It does not directly remediate the current finding at Elmwood Manufacturing: A malicious process attempts to leak data through ICMP payloads rather than common web ports. The relevant corrective control for this case is: Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic.

Detect protocol-abuse deviations and restrict NTP to approved time sources. That action fits another problem: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. It does not directly remediate the current finding at Elmwood Manufacturing: A malicious process attempts to leak data through ICMP payloads rather than common web ports. The relevant corrective control for this case is: Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic.

Use application-aware egress policy and DLP across approved and unapproved transfer channels. That action fits another problem: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. It does not directly remediate the current finding at Elmwood Manufacturing: A malicious process attempts to leak data through ICMP payloads rather than common web ports. The relevant corrective control for this case is: Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic.

A protected data sample is stopped across relevant channels rather than just FTP. This would be relevant evidence for a different failure: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps, usually addressed by Use application-aware egress policy and DLP across approved and unapproved transfer channels. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

Unapproved outbound file-transfer traffic is denied and correlated with source activity. This would be relevant evidence for a different failure: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight, usually addressed by Apply egress controls and investigate host and flow telemetry for unauthorized transfer. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.