Exam Bundle

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary.

Implement multiple preventive and detective layers for identity, network, host, and applications. That action fits another problem: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. It does not directly remediate the current finding at Trident Finance: Administrators use the same account for routine email and firewall changes. The relevant corrective control for this case is: Separate administrative identities and require privileged access controls for management operations.

Segment network roles and require explicit inter-zone policy enforcement. That action fits another problem: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. It does not directly remediate the current finding at Trident Finance: Administrators use the same account for routine email and firewall changes. The relevant corrective control for this case is: Separate administrative identities and require privileged access controls for management operations.

Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. That action fits another problem: Security architects choose individual products without recording trust boundaries or critical assets. It does not directly remediate the current finding at Trident Finance: Administrators use the same account for routine email and firewall changes. The relevant corrective control for this case is: Separate administrative identities and require privileged access controls for management operations.

A simulated internal threat is blocked or detected by controls beyond the perimeter. This would be relevant evidence for a different failure: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise, usually addressed by Implement multiple preventive and detective layers for identity, network, host, and applications. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: Routine accounts cannot change firewall policy and privileged sessions are individually audited.

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: Routine accounts cannot change firewall policy and privileged sessions are individually audited.

The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary. This would be relevant evidence for a different failure: Security architects choose individual products without recording trust boundaries or critical assets, usually addressed by Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: Routine accounts cannot change firewall policy and privileged sessions are individually audited.

Add monitored telemetry and response processes as a detective layer alongside prevention. That action fits another problem: A datacenter deploys endpoint protection but no centralized logging or incident correlation. It does not directly remediate the current finding at Seabright Municipal Works: Administrators use the same account for routine email and firewall changes. The relevant corrective control for this case is: Separate administrative identities and require privileged access controls for management operations.

Segment network roles and require explicit inter-zone policy enforcement. That action fits another problem: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. It does not directly remediate the current finding at Seabright Municipal Works: Administrators use the same account for routine email and firewall changes. The relevant corrective control for this case is: Separate administrative identities and require privileged access controls for management operations.

Design incident containment, backup recovery, and resilience processes as complementary layers. That action fits another problem: A security program has excellent prevention but no tested recovery or containment path after compromise. It does not directly remediate the current finding at Seabright Municipal Works: Administrators use the same account for routine email and firewall changes. The relevant corrective control for this case is: Separate administrative identities and require privileged access controls for management operations.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: Routine accounts cannot change firewall policy and privileged sessions are individually audited.

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: Routine accounts cannot change firewall policy and privileged sessions are individually audited.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: Routine accounts cannot change firewall policy and privileged sessions are individually audited.

Add monitored telemetry and response processes as a detective layer alongside prevention. That action fits another problem: A datacenter deploys endpoint protection but no centralized logging or incident correlation. It does not directly remediate the current finding at Prairie Health Network: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. The relevant corrective control for this case is: Segment network roles and require explicit inter-zone policy enforcement.

Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. That action fits another problem: Security architects choose individual products without recording trust boundaries or critical assets. It does not directly remediate the current finding at Prairie Health Network: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. The relevant corrective control for this case is: Segment network roles and require explicit inter-zone policy enforcement.

Separate administrative identities and require privileged access controls for management operations. That action fits another problem: Administrators use the same account for routine email and firewall changes. It does not directly remediate the current finding at Prairie Health Network: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. The relevant corrective control for this case is: Segment network roles and require explicit inter-zone policy enforcement.

The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary. This would be relevant evidence for a different failure: Security architects choose individual products without recording trust boundaries or critical assets, usually addressed by Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A compromised user workstation cannot connect directly to device management interfaces.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A compromised user workstation cannot connect directly to device management interfaces.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A compromised user workstation cannot connect directly to device management interfaces.

Add monitored telemetry and response processes as a detective layer alongside prevention. That action fits another problem: A datacenter deploys endpoint protection but no centralized logging or incident correlation. It does not directly remediate the current finding at Boreal Foods: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. The relevant corrective control for this case is: Segment network roles and require explicit inter-zone policy enforcement.

Design incident containment, backup recovery, and resilience processes as complementary layers. That action fits another problem: A security program has excellent prevention but no tested recovery or containment path after compromise. It does not directly remediate the current finding at Boreal Foods: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. The relevant corrective control for this case is: Segment network roles and require explicit inter-zone policy enforcement.

Implement multiple preventive and detective layers for identity, network, host, and applications. That action fits another problem: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. It does not directly remediate the current finding at Boreal Foods: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. The relevant corrective control for this case is: Segment network roles and require explicit inter-zone policy enforcement.

A simulated internal threat is blocked or detected by controls beyond the perimeter. This would be relevant evidence for a different failure: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise, usually addressed by Implement multiple preventive and detective layers for identity, network, host, and applications. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A compromised user workstation cannot connect directly to device management interfaces.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A compromised user workstation cannot connect directly to device management interfaces.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A compromised user workstation cannot connect directly to device management interfaces.

Separate administrative identities and require privileged access controls for management operations. That action fits another problem: Administrators use the same account for routine email and firewall changes. It does not directly remediate the current finding at Willowbrook Education: A datacenter deploys endpoint protection but no centralized logging or incident correlation. The relevant corrective control for this case is: Add monitored telemetry and response processes as a detective layer alongside prevention.

Design incident containment, backup recovery, and resilience processes as complementary layers. That action fits another problem: A security program has excellent prevention but no tested recovery or containment path after compromise. It does not directly remediate the current finding at Willowbrook Education: A datacenter deploys endpoint protection but no centralized logging or incident correlation. The relevant corrective control for this case is: Add monitored telemetry and response processes as a detective layer alongside prevention.

Segment network roles and require explicit inter-zone policy enforcement. That action fits another problem: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. It does not directly remediate the current finding at Willowbrook Education: A datacenter deploys endpoint protection but no centralized logging or incident correlation. The relevant corrective control for this case is: Add monitored telemetry and response processes as a detective layer alongside prevention.

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.