Exam Bundle

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A compromised internal subnet host cannot reach finance data without valid identity and posture.

A simulated account-risk change causes policy enforcement before the next sensitive transaction. This would be relevant evidence for a different failure: A legacy authentication design grants permanent trust to sessions after one password check, usually addressed by Define a continuously evaluated policy engine with per-request access controls and context signals. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A compromised internal subnet host cannot reach finance data without valid identity and posture.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A compromised internal subnet host cannot reach finance data without valid identity and posture.

Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. That action fits another problem: A cloud service gives every employee broad administrative API permissions after single sign-on. It does not directly remediate the current finding at Arborstone Tech: An internal finance app trusts devices solely because their network address is inside the corporate subnet. The relevant corrective control for this case is: Require identity and device-state verification at each access decision with least privilege.

Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. That action fits another problem: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. It does not directly remediate the current finding at Arborstone Tech: An internal finance app trusts devices solely because their network address is inside the corporate subnet. The relevant corrective control for this case is: Require identity and device-state verification at each access decision with least privilege.

Define a continuously evaluated policy engine with per-request access controls and context signals. That action fits another problem: A legacy authentication design grants permanent trust to sessions after one password check. It does not directly remediate the current finding at Arborstone Tech: An internal finance app trusts devices solely because their network address is inside the corporate subnet. The relevant corrective control for this case is: Require identity and device-state verification at each access decision with least privilege.

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A compromised internal subnet host cannot reach finance data without valid identity and posture.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A compromised internal subnet host cannot reach finance data without valid identity and posture.

A simulated account-risk change causes policy enforcement before the next sensitive transaction. This would be relevant evidence for a different failure: A legacy authentication design grants permanent trust to sessions after one password check, usually addressed by Define a continuously evaluated policy engine with per-request access controls and context signals. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A compromised internal subnet host cannot reach finance data without valid identity and posture.

Define a continuously evaluated policy engine with per-request access controls and context signals. That action fits another problem: A legacy authentication design grants permanent trust to sessions after one password check. It does not directly remediate the current finding at Sapphire Data Systems: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. The relevant corrective control for this case is: Continuously reassess session risk and device posture and revoke or reauthorize when conditions change.

Require identity and device-state verification at each access decision with least privilege. That action fits another problem: An internal finance app trusts devices solely because their network address is inside the corporate subnet. It does not directly remediate the current finding at Sapphire Data Systems: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. The relevant corrective control for this case is: Continuously reassess session risk and device posture and revoke or reauthorize when conditions change.

Adopt application-specific zero-trust access based on user, device, and resource policy. That action fits another problem: Remote contractors can access every internal service after a single perimeter VPN login. It does not directly remediate the current finding at Sapphire Data Systems: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. The relevant corrective control for this case is: Continuously reassess session risk and device posture and revoke or reauthorize when conditions change.

A simulated account-risk change causes policy enforcement before the next sensitive transaction. This would be relevant evidence for a different failure: A legacy authentication design grants permanent trust to sessions after one password check, usually addressed by Define a continuously evaluated policy engine with per-request access controls and context signals. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: A posture-change event terminates the sensitive session before additional data access.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: A posture-change event terminates the sensitive session before additional data access.

A compromised internal subnet host cannot reach finance data without valid identity and posture. This would be relevant evidence for a different failure: An internal finance app trusts devices solely because their network address is inside the corporate subnet, usually addressed by Require identity and device-state verification at each access decision with least privilege. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: A posture-change event terminates the sensitive session before additional data access.

Apply identity-aware microsegmentation and explicit workload-to-workload policies. That action fits another problem: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. It does not directly remediate the current finding at Eastport Research Hospital: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. The relevant corrective control for this case is: Continuously reassess session risk and device posture and revoke or reauthorize when conditions change.

Require identity and device-state verification at each access decision with least privilege. That action fits another problem: An internal finance app trusts devices solely because their network address is inside the corporate subnet. It does not directly remediate the current finding at Eastport Research Hospital: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. The relevant corrective control for this case is: Continuously reassess session risk and device posture and revoke or reauthorize when conditions change.

Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. That action fits another problem: A cloud service gives every employee broad administrative API permissions after single sign-on. It does not directly remediate the current finding at Eastport Research Hospital: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. The relevant corrective control for this case is: Continuously reassess session risk and device posture and revoke or reauthorize when conditions change.

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: A posture-change event terminates the sensitive session before additional data access.

A compromised internal subnet host cannot reach finance data without valid identity and posture. This would be relevant evidence for a different failure: An internal finance app trusts devices solely because their network address is inside the corporate subnet, usually addressed by Require identity and device-state verification at each access decision with least privilege. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: A posture-change event terminates the sensitive session before additional data access.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: A posture-change event terminates the sensitive session before additional data access.

Require identity and device-state verification at each access decision with least privilege. That action fits another problem: An internal finance app trusts devices solely because their network address is inside the corporate subnet. It does not directly remediate the current finding at Frostline Distribution: A cloud service gives every employee broad administrative API permissions after single sign-on. The relevant corrective control for this case is: Apply role-based least privilege and just-in-time privileged elevation with auditable conditions.

Define a continuously evaluated policy engine with per-request access controls and context signals. That action fits another problem: A legacy authentication design grants permanent trust to sessions after one password check. It does not directly remediate the current finding at Frostline Distribution: A cloud service gives every employee broad administrative API permissions after single sign-on. The relevant corrective control for this case is: Apply role-based least privilege and just-in-time privileged elevation with auditable conditions.

Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. That action fits another problem: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. It does not directly remediate the current finding at Frostline Distribution: A cloud service gives every employee broad administrative API permissions after single sign-on. The relevant corrective control for this case is: Apply role-based least privilege and just-in-time privileged elevation with auditable conditions.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

A compromised internal subnet host cannot reach finance data without valid identity and posture. This would be relevant evidence for a different failure: An internal finance app trusts devices solely because their network address is inside the corporate subnet, usually addressed by Require identity and device-state verification at each access decision with least privilege. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

A simulated account-risk change causes policy enforcement before the next sensitive transaction. This would be relevant evidence for a different failure: A legacy authentication design grants permanent trust to sessions after one password check, usually addressed by Define a continuously evaluated policy engine with per-request access controls and context signals. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

Apply identity-aware microsegmentation and explicit workload-to-workload policies. That action fits another problem: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. It does not directly remediate the current finding at Aster Mutual: A cloud service gives every employee broad administrative API permissions after single sign-on. The relevant corrective control for this case is: Apply role-based least privilege and just-in-time privileged elevation with auditable conditions.

Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. That action fits another problem: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. It does not directly remediate the current finding at Aster Mutual: A cloud service gives every employee broad administrative API permissions after single sign-on. The relevant corrective control for this case is: Apply role-based least privilege and just-in-time privileged elevation with auditable conditions.

Adopt application-specific zero-trust access based on user, device, and resource policy. That action fits another problem: Remote contractors can access every internal service after a single perimeter VPN login. It does not directly remediate the current finding at Aster Mutual: A cloud service gives every employee broad administrative API permissions after single sign-on. The relevant corrective control for this case is: Apply role-based least privilege and just-in-time privileged elevation with auditable conditions.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.