Exam Bundle

Ordinary employees cannot call administrative endpoints; approved time-bound elevation works. This would be relevant evidence for a different failure: A cloud service gives every employee broad administrative API permissions after single sign-on, usually addressed by Apply role-based least privilege and just-in-time privileged elevation with auditable conditions. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

A service reaches only its approved dependency regardless of its assigned subnet. This would be relevant evidence for a different failure: Network segmentation is based only on data-center VLAN placement, leaving workload identities unverified, usually addressed by Apply identity-aware microsegmentation and explicit workload-to-workload policies. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. That action fits another problem: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised. It does not directly remediate the current finding at Bluewater Technology: A legacy authentication design grants permanent trust to sessions after one password check. The relevant corrective control for this case is: Define a continuously evaluated policy engine with per-request access controls and context signals.

Require identity and device-state verification at each access decision with least privilege. That action fits another problem: An internal finance app trusts devices solely because their network address is inside the corporate subnet. It does not directly remediate the current finding at Bluewater Technology: A legacy authentication design grants permanent trust to sessions after one password check. The relevant corrective control for this case is: Define a continuously evaluated policy engine with per-request access controls and context signals.

Adopt application-specific zero-trust access based on user, device, and resource policy. That action fits another problem: Remote contractors can access every internal service after a single perimeter VPN login. It does not directly remediate the current finding at Bluewater Technology: A legacy authentication design grants permanent trust to sessions after one password check. The relevant corrective control for this case is: Define a continuously evaluated policy engine with per-request access controls and context signals.

A contractor reaches only assigned applications and unrelated services remain inaccessible. This would be relevant evidence for a different failure: Remote contractors can access every internal service after a single perimeter VPN login, usually addressed by Adopt application-specific zero-trust access based on user, device, and resource policy. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

A compromised internal subnet host cannot reach finance data without valid identity and posture. This would be relevant evidence for a different failure: An internal finance app trusts devices solely because their network address is inside the corporate subnet, usually addressed by Require identity and device-state verification at each access decision with least privilege. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

A posture-change event terminates the sensitive session before additional data access. This would be relevant evidence for a different failure: A user authenticated in the morning keeps privileged access after the endpoint becomes compromised, usually addressed by Continuously reassess session risk and device posture and revoke or reauthorize when conditions change. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A simulated account-risk change causes policy enforcement before the next sensitive transaction.

Add monitored telemetry and response processes as a detective layer alongside prevention. That action fits another problem: A datacenter deploys endpoint protection but no centralized logging or incident correlation. It does not directly remediate the current finding at Ridgeview Finance: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. The relevant corrective control for this case is: Implement multiple preventive and detective layers for identity, network, host, and applications.

Design incident containment, backup recovery, and resilience processes as complementary layers. That action fits another problem: A security program has excellent prevention but no tested recovery or containment path after compromise. It does not directly remediate the current finding at Ridgeview Finance: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. The relevant corrective control for this case is: Implement multiple preventive and detective layers for identity, network, host, and applications.

Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. That action fits another problem: Security architects choose individual products without recording trust boundaries or critical assets. It does not directly remediate the current finding at Ridgeview Finance: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. The relevant corrective control for this case is: Implement multiple preventive and detective layers for identity, network, host, and applications.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: A simulated internal threat is blocked or detected by controls beyond the perimeter.

The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary. This would be relevant evidence for a different failure: Security architects choose individual products without recording trust boundaries or critical assets, usually addressed by Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: A simulated internal threat is blocked or detected by controls beyond the perimeter.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: A simulated internal threat is blocked or detected by controls beyond the perimeter.

Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. That action fits another problem: Security architects choose individual products without recording trust boundaries or critical assets. It does not directly remediate the current finding at Pinecrest Research: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. The relevant corrective control for this case is: Implement multiple preventive and detective layers for identity, network, host, and applications.

Separate administrative identities and require privileged access controls for management operations. That action fits another problem: Administrators use the same account for routine email and firewall changes. It does not directly remediate the current finding at Pinecrest Research: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. The relevant corrective control for this case is: Implement multiple preventive and detective layers for identity, network, host, and applications.

Segment network roles and require explicit inter-zone policy enforcement. That action fits another problem: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. It does not directly remediate the current finding at Pinecrest Research: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. The relevant corrective control for this case is: Implement multiple preventive and detective layers for identity, network, host, and applications.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: A simulated internal threat is blocked or detected by controls beyond the perimeter.

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: A simulated internal threat is blocked or detected by controls beyond the perimeter.

The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary. This would be relevant evidence for a different failure: Security architects choose individual products without recording trust boundaries or critical assets, usually addressed by Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: A simulated internal threat is blocked or detected by controls beyond the perimeter.

Implement multiple preventive and detective layers for identity, network, host, and applications. That action fits another problem: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. It does not directly remediate the current finding at Summit Logistics: Security architects choose individual products without recording trust boundaries or critical assets. The relevant corrective control for this case is: Use a threat-informed SAFE-style architecture to map assets, zones, and security controls.

Separate administrative identities and require privileged access controls for management operations. That action fits another problem: Administrators use the same account for routine email and firewall changes. It does not directly remediate the current finding at Summit Logistics: Security architects choose individual products without recording trust boundaries or critical assets. The relevant corrective control for this case is: Use a threat-informed SAFE-style architecture to map assets, zones, and security controls.

Design incident containment, backup recovery, and resilience processes as complementary layers. That action fits another problem: A security program has excellent prevention but no tested recovery or containment path after compromise. It does not directly remediate the current finding at Summit Logistics: Security architects choose individual products without recording trust boundaries or critical assets. The relevant corrective control for this case is: Use a threat-informed SAFE-style architecture to map assets, zones, and security controls.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

A simulated internal threat is blocked or detected by controls beyond the perimeter. This would be relevant evidence for a different failure: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise, usually addressed by Implement multiple preventive and detective layers for identity, network, host, and applications. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

Separate administrative identities and require privileged access controls for management operations. That action fits another problem: Administrators use the same account for routine email and firewall changes. It does not directly remediate the current finding at Maple Creek Agriculture: Security architects choose individual products without recording trust boundaries or critical assets. The relevant corrective control for this case is: Use a threat-informed SAFE-style architecture to map assets, zones, and security controls.

Add monitored telemetry and response processes as a detective layer alongside prevention. That action fits another problem: A datacenter deploys endpoint protection but no centralized logging or incident correlation. It does not directly remediate the current finding at Maple Creek Agriculture: Security architects choose individual products without recording trust boundaries or critical assets. The relevant corrective control for this case is: Use a threat-informed SAFE-style architecture to map assets, zones, and security controls.

Segment network roles and require explicit inter-zone policy enforcement. That action fits another problem: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. It does not directly remediate the current finding at Maple Creek Agriculture: Security architects choose individual products without recording trust boundaries or critical assets. The relevant corrective control for this case is: Use a threat-informed SAFE-style architecture to map assets, zones, and security controls.

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.