Exam Bundle

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: Ordinary employees cannot call administrative endpoints; approved time-bound elevation works.

Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. That action fits another problem: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. It does not directly remediate the current finding at Horizon Energy Services: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. The relevant corrective control for this case is: Apply identity-aware microsegmentation and explicit workload-to-workload policies.

Require identity and device-state verification at each access decision with least privilege. That action fits another problem: An internal finance app trusts devices solely because their network address is inside the corporate subnet. It does not directly remediate the current finding at Horizon Energy Services: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. The relevant corrective control for this case is: Apply identity-aware microsegmentation and explicit workload-to-workload policies.

Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. That action fits another problem: A cloud service gives every employee broad administrative API permissions after single sign-on. It does not directly remediate the current finding at Horizon Energy Services: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. The relevant corrective control for this case is: Apply identity-aware microsegmentation and explicit workload-to-workload policies.

A compromised internal subnet host cannot reach finance data without valid identity and posture. This would be relevant evidence for a different failure: An internal finance app trusts devices solely because their network address is inside the corporate subnet, usually addressed by Require identity and device-state verification at each access decision with least privilege. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: A service reaches only its approved dependency regardless of its assigned subnet.

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: A service reaches only its approved dependency regardless of its assigned subnet.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: A service reaches only its approved dependency regardless of its assigned subnet.

Adopt application-specific zero-trust access based on user, device, and resource policy. That action fits another problem: Remote contractors can access every internal service after a single perimeter VPN login. It does not directly remediate the current finding at Newbridge Charity: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. The relevant corrective control for this case is: Apply identity-aware microsegmentation and explicit workload-to-workload policies.

Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. That action fits another problem: A cloud service gives every employee broad administrative API permissions after single sign-on. It does not directly remediate the current finding at Newbridge Charity: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. The relevant corrective control for this case is: Apply identity-aware microsegmentation and explicit workload-to-workload policies.

Define a continuously evaluated policy engine with per-request access controls and context signals. That action fits another problem: A legacy authentication design grants permanent trust to sessions after one password check. It does not directly remediate the current finding at Newbridge Charity: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. The relevant corrective control for this case is: Apply identity-aware microsegmentation and explicit workload-to-workload policies.

A simulated account-risk change causes policy enforcement before the next sensitive transaction. This would be relevant evidence for a different failure: A legacy authentication design grants permanent trust to sessions after one password check, usually addressed by Define a continuously evaluated policy engine with per-request access controls and context signals. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: A service reaches only its approved dependency regardless of its assigned subnet.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: A service reaches only its approved dependency regardless of its assigned subnet.

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: A service reaches only its approved dependency regardless of its assigned subnet.

Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. That action fits another problem: A cloud service gives every employee broad administrative API permissions after single sign-on. It does not directly remediate the current finding at Harbor Point Medical: Remote contractors can access every internal service after a single perimeter VPN login. The relevant corrective control for this case is: Adopt application-specific zero-trust access based on user, device, and resource policy.

Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. That action fits another problem: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. It does not directly remediate the current finding at Harbor Point Medical: Remote contractors can access every internal service after a single perimeter VPN login. The relevant corrective control for this case is: Adopt application-specific zero-trust access based on user, device, and resource policy.

Apply identity-aware microsegmentation and explicit workload-to-workload policies. That action fits another problem: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. It does not directly remediate the current finding at Harbor Point Medical: Remote contractors can access every internal service after a single perimeter VPN login. The relevant corrective control for this case is: Adopt application-specific zero-trust access based on user, device, and resource policy.

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: A contractor reaches only assigned applications and unrelated services remain inaccessible.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: A contractor reaches only assigned applications and unrelated services remain inaccessible.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: A contractor reaches only assigned applications and unrelated services remain inaccessible.

Define a continuously evaluated policy engine with per-request access controls and context signals. That action fits another problem: A legacy authentication design grants permanent trust to sessions after one password check. It does not directly remediate the current finding at Clearbrook University: Remote contractors can access every internal service after a single perimeter VPN login. The relevant corrective control for this case is: Adopt application-specific zero-trust access based on user, device, and resource policy.

Apply identity-aware microsegmentation and explicit workload-to-workload policies. That action fits another problem: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. It does not directly remediate the current finding at Clearbrook University: Remote contractors can access every internal service after a single perimeter VPN login. The relevant corrective control for this case is: Adopt application-specific zero-trust access based on user, device, and resource policy.

Require identity and device-state verification at each access decision with least privilege. That action fits another problem: An internal finance app trusts devices solely because their network address is inside the corporate subnet. It does not directly remediate the current finding at Clearbrook University: Remote contractors can access every internal service after a single perimeter VPN login. The relevant corrective control for this case is: Adopt application-specific zero-trust access based on user, device, and resource policy.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: A contractor reaches only assigned applications and unrelated services remain inaccessible.

A simulated account-risk change causes policy enforcement before the next sensitive transaction. This would be relevant evidence for a different failure: A legacy authentication design grants permanent trust to sessions after one password check, usually addressed by Define a continuously evaluated policy engine with per-request access controls and context signals. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: A contractor reaches only assigned applications and unrelated services remain inaccessible.

A compromised internal subnet host cannot reach finance data without valid identity and posture. This would be relevant evidence for a different failure: An internal finance app trusts devices solely because their network address is inside the corporate subnet, usually addressed by Require identity and device-state verification at each access decision with least privilege. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: A contractor reaches only assigned applications and unrelated services remain inaccessible.

Apply identity-aware microsegmentation and explicit workload-to-workload policies. That action fits another problem: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified. It does not directly remediate the current finding at Oceanview Payments: A legacy authentication design grants permanent trust to sessions after one password check. The relevant corrective control for this case is: Define a continuously evaluated policy engine with per-request access controls and context signals.

Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. That action fits another problem: A cloud service gives every employee broad administrative API permissions after single sign-on. It does not directly remediate the current finding at Oceanview Payments: A legacy authentication design grants permanent trust to sessions after one password check. The relevant corrective control for this case is: Define a continuously evaluated policy engine with per-request access controls and context signals.

Adopt application-specific zero-trust access based on user, device, and resource policy. That action fits another problem: Remote contractors can access every internal service after a single perimeter VPN login. It does not directly remediate the current finding at Oceanview Payments: A legacy authentication design grants permanent trust to sessions after one password check. The relevant corrective control for this case is: Define a continuously evaluated policy engine with per-request access controls and context signals.

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.