Exam Bundle

A protected data sample is stopped across relevant channels rather than just FTP. This would be relevant evidence for a different failure: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps, usually addressed by Use application-aware egress policy and DLP across approved and unapproved transfer channels. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

Unapproved outbound file-transfer traffic is denied and correlated with source activity. This would be relevant evidence for a different failure: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight, usually addressed by Apply egress controls and investigate host and flow telemetry for unauthorized transfer. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. That action fits another problem: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. It does not directly remediate the current finding at Linden Manufacturing: A malicious process attempts to leak data through ICMP payloads rather than common web ports. The relevant corrective control for this case is: Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic.

Use application-aware egress policy and DLP across approved and unapproved transfer channels. That action fits another problem: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. It does not directly remediate the current finding at Linden Manufacturing: A malicious process attempts to leak data through ICMP payloads rather than common web ports. The relevant corrective control for this case is: Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic.

Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. That action fits another problem: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior. It does not directly remediate the current finding at Linden Manufacturing: A malicious process attempts to leak data through ICMP payloads rather than common web ports. The relevant corrective control for this case is: Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic.

A protected data sample is stopped across relevant channels rather than just FTP. This would be relevant evidence for a different failure: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps, usually addressed by Use application-aware egress policy and DLP across approved and unapproved transfer channels. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

A controlled tunneling simulation raises an event while routine DNS requests work. This would be relevant evidence for a different failure: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior, usually addressed by Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues. This would be relevant evidence for a different failure: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session, usually addressed by Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: The covert-transfer test creates an alert and cannot move meaningful protected data.

Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. That action fits another problem: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior. It does not directly remediate the current finding at Harbor Retail: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. The relevant corrective control for this case is: Detect protocol-abuse deviations and restrict NTP to approved time sources.

Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. That action fits another problem: A malicious process attempts to leak data through ICMP payloads rather than common web ports. It does not directly remediate the current finding at Harbor Retail: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. The relevant corrective control for this case is: Detect protocol-abuse deviations and restrict NTP to approved time sources.

Use application-aware egress policy and DLP across approved and unapproved transfer channels. That action fits another problem: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. It does not directly remediate the current finding at Harbor Retail: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. The relevant corrective control for this case is: Detect protocol-abuse deviations and restrict NTP to approved time sources.

A protected data sample is stopped across relevant channels rather than just FTP. This would be relevant evidence for a different failure: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps, usually addressed by Use application-aware egress policy and DLP across approved and unapproved transfer channels. It does not demonstrate that the current problem at Harbor Retail was resolved. The specific required evidence is: Normal time synchronization works and the unexpected transfer path is blocked.

The covert-transfer test creates an alert and cannot move meaningful protected data. This would be relevant evidence for a different failure: A malicious process attempts to leak data through ICMP payloads rather than common web ports, usually addressed by Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. It does not demonstrate that the current problem at Harbor Retail was resolved. The specific required evidence is: Normal time synchronization works and the unexpected transfer path is blocked.

A controlled tunneling simulation raises an event while routine DNS requests work. This would be relevant evidence for a different failure: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior, usually addressed by Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. It does not demonstrate that the current problem at Harbor Retail was resolved. The specific required evidence is: Normal time synchronization works and the unexpected transfer path is blocked.

Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. That action fits another problem: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. It does not directly remediate the current finding at Evermere Health: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. The relevant corrective control for this case is: Detect protocol-abuse deviations and restrict NTP to approved time sources.

Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. That action fits another problem: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior. It does not directly remediate the current finding at Evermere Health: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. The relevant corrective control for this case is: Detect protocol-abuse deviations and restrict NTP to approved time sources.

Apply egress controls and investigate host and flow telemetry for unauthorized transfer. That action fits another problem: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. It does not directly remediate the current finding at Evermere Health: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. The relevant corrective control for this case is: Detect protocol-abuse deviations and restrict NTP to approved time sources.

The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues. This would be relevant evidence for a different failure: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session, usually addressed by Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: Normal time synchronization works and the unexpected transfer path is blocked.

A controlled tunneling simulation raises an event while routine DNS requests work. This would be relevant evidence for a different failure: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior, usually addressed by Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: Normal time synchronization works and the unexpected transfer path is blocked.

Unapproved outbound file-transfer traffic is denied and correlated with source activity. This would be relevant evidence for a different failure: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight, usually addressed by Apply egress controls and investigate host and flow telemetry for unauthorized transfer. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: Normal time synchronization works and the unexpected transfer path is blocked.

Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. That action fits another problem: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. It does not directly remediate the current finding at Cedar City Utilities: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. The relevant corrective control for this case is: Use application-aware egress policy and DLP across approved and unapproved transfer channels.

Detect protocol-abuse deviations and restrict NTP to approved time sources. That action fits another problem: A host sends repeated NTP packets with unusual application-sized content to an external endpoint. It does not directly remediate the current finding at Cedar City Utilities: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. The relevant corrective control for this case is: Use application-aware egress policy and DLP across approved and unapproved transfer channels.

Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. That action fits another problem: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior. It does not directly remediate the current finding at Cedar City Utilities: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. The relevant corrective control for this case is: Use application-aware egress policy and DLP across approved and unapproved transfer channels.

The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues. This would be relevant evidence for a different failure: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session, usually addressed by Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. It does not demonstrate that the current problem at Cedar City Utilities was resolved. The specific required evidence is: A protected data sample is stopped across relevant channels rather than just FTP.

Normal time synchronization works and the unexpected transfer path is blocked. This would be relevant evidence for a different failure: A host sends repeated NTP packets with unusual application-sized content to an external endpoint, usually addressed by Detect protocol-abuse deviations and restrict NTP to approved time sources. It does not demonstrate that the current problem at Cedar City Utilities was resolved. The specific required evidence is: A protected data sample is stopped across relevant channels rather than just FTP.

A controlled tunneling simulation raises an event while routine DNS requests work. This would be relevant evidence for a different failure: A compromised endpoint sends unusually long encoded DNS queries to attacker-controlled domains outside normal resolution behavior, usually addressed by Detect and constrain DNS tunneling using query anomaly monitoring and DNS-layer policy. It does not demonstrate that the current problem at Cedar City Utilities was resolved. The specific required evidence is: A protected data sample is stopped across relevant channels rather than just FTP.

Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. That action fits another problem: A malicious process attempts to leak data through ICMP payloads rather than common web ports. It does not directly remediate the current finding at Vantage Travel: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. The relevant corrective control for this case is: Use application-aware egress policy and DLP across approved and unapproved transfer channels.

Apply egress controls and investigate host and flow telemetry for unauthorized transfer. That action fits another problem: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight. It does not directly remediate the current finding at Vantage Travel: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. The relevant corrective control for this case is: Use application-aware egress policy and DLP across approved and unapproved transfer channels.

Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. That action fits another problem: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session. It does not directly remediate the current finding at Vantage Travel: A team blocks FTP exfiltration but ignores equivalent paths through secure chat and file-sharing apps. The relevant corrective control for this case is: Use application-aware egress policy and DLP across approved and unapproved transfer channels.

Unapproved outbound file-transfer traffic is denied and correlated with source activity. This would be relevant evidence for a different failure: An internal server opens unexpected outbound SSH/SCP sessions to unknown Internet destinations overnight, usually addressed by Apply egress controls and investigate host and flow telemetry for unauthorized transfer. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A protected data sample is stopped across relevant channels rather than just FTP.

The restricted file transfer is blocked or reviewed while permitted SaaS traffic continues. This would be relevant evidence for a different failure: An employee uploads a confidential file to personal cloud storage using an otherwise permitted HTTPS session, usually addressed by Use appropriate DLP and sanctioned-application policy with inspection consistent with privacy rules. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A protected data sample is stopped across relevant channels rather than just FTP.

The covert-transfer test creates an alert and cannot move meaningful protected data. This would be relevant evidence for a different failure: A malicious process attempts to leak data through ICMP payloads rather than common web ports, usually addressed by Monitor unusual ICMP volume and payload patterns and limit unneeded egress traffic. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A protected data sample is stopped across relevant channels rather than just FTP.