Exam Bundle

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. That action fits another problem: Security architects choose individual products without recording trust boundaries or critical assets. It does not directly remediate the current finding at Oak River Energy: A datacenter deploys endpoint protection but no centralized logging or incident correlation. The relevant corrective control for this case is: Add monitored telemetry and response processes as a detective layer alongside prevention.

Design incident containment, backup recovery, and resilience processes as complementary layers. That action fits another problem: A security program has excellent prevention but no tested recovery or containment path after compromise. It does not directly remediate the current finding at Oak River Energy: A datacenter deploys endpoint protection but no centralized logging or incident correlation. The relevant corrective control for this case is: Add monitored telemetry and response processes as a detective layer alongside prevention.

Implement multiple preventive and detective layers for identity, network, host, and applications. That action fits another problem: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. It does not directly remediate the current finding at Oak River Energy: A datacenter deploys endpoint protection but no centralized logging or incident correlation. The relevant corrective control for this case is: Add monitored telemetry and response processes as a detective layer alongside prevention.

A simulated internal threat is blocked or detected by controls beyond the perimeter. This would be relevant evidence for a different failure: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise, usually addressed by Implement multiple preventive and detective layers for identity, network, host, and applications. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary. This would be relevant evidence for a different failure: Security architects choose individual products without recording trust boundaries or critical assets, usually addressed by Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

A tabletop or controlled exercise restores protected service while containing the simulated threat. This would be relevant evidence for a different failure: A security program has excellent prevention but no tested recovery or containment path after compromise, usually addressed by Design incident containment, backup recovery, and resilience processes as complementary layers. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: A seeded suspicious event generates a correlated incident with an accountable responder.

Segment network roles and require explicit inter-zone policy enforcement. That action fits another problem: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone. It does not directly remediate the current finding at Westlake Retail: A security program has excellent prevention but no tested recovery or containment path after compromise. The relevant corrective control for this case is: Design incident containment, backup recovery, and resilience processes as complementary layers.

Add monitored telemetry and response processes as a detective layer alongside prevention. That action fits another problem: A datacenter deploys endpoint protection but no centralized logging or incident correlation. It does not directly remediate the current finding at Westlake Retail: A security program has excellent prevention but no tested recovery or containment path after compromise. The relevant corrective control for this case is: Design incident containment, backup recovery, and resilience processes as complementary layers.

Implement multiple preventive and detective layers for identity, network, host, and applications. That action fits another problem: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. It does not directly remediate the current finding at Westlake Retail: A security program has excellent prevention but no tested recovery or containment path after compromise. The relevant corrective control for this case is: Design incident containment, backup recovery, and resilience processes as complementary layers.

A simulated internal threat is blocked or detected by controls beyond the perimeter. This would be relevant evidence for a different failure: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise, usually addressed by Implement multiple preventive and detective layers for identity, network, host, and applications. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: A tabletop or controlled exercise restores protected service while containing the simulated threat.

A compromised user workstation cannot connect directly to device management interfaces. This would be relevant evidence for a different failure: A campus network places user devices, servers, and management interfaces in one unrestricted trust zone, usually addressed by Segment network roles and require explicit inter-zone policy enforcement. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: A tabletop or controlled exercise restores protected service while containing the simulated threat.

A seeded suspicious event generates a correlated incident with an accountable responder. This would be relevant evidence for a different failure: A datacenter deploys endpoint protection but no centralized logging or incident correlation, usually addressed by Add monitored telemetry and response processes as a detective layer alongside prevention. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: A tabletop or controlled exercise restores protected service while containing the simulated threat.

Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. That action fits another problem: Security architects choose individual products without recording trust boundaries or critical assets. It does not directly remediate the current finding at Blue Haven Media: A security program has excellent prevention but no tested recovery or containment path after compromise. The relevant corrective control for this case is: Design incident containment, backup recovery, and resilience processes as complementary layers.

Implement multiple preventive and detective layers for identity, network, host, and applications. That action fits another problem: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise. It does not directly remediate the current finding at Blue Haven Media: A security program has excellent prevention but no tested recovery or containment path after compromise. The relevant corrective control for this case is: Design incident containment, backup recovery, and resilience processes as complementary layers.

Separate administrative identities and require privileged access controls for management operations. That action fits another problem: Administrators use the same account for routine email and firewall changes. It does not directly remediate the current finding at Blue Haven Media: A security program has excellent prevention but no tested recovery or containment path after compromise. The relevant corrective control for this case is: Design incident containment, backup recovery, and resilience processes as complementary layers.

A simulated internal threat is blocked or detected by controls beyond the perimeter. This would be relevant evidence for a different failure: A corporate security design relies exclusively on one perimeter firewall, with no detection after internal compromise, usually addressed by Implement multiple preventive and detective layers for identity, network, host, and applications. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: A tabletop or controlled exercise restores protected service while containing the simulated threat.

Routine accounts cannot change firewall policy and privileged sessions are individually audited. This would be relevant evidence for a different failure: Administrators use the same account for routine email and firewall changes, usually addressed by Separate administrative identities and require privileged access controls for management operations. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: A tabletop or controlled exercise restores protected service while containing the simulated threat.

The reviewed diagram identifies critical flows, attack paths, and the protections at each boundary. This would be relevant evidence for a different failure: Security architects choose individual products without recording trust boundaries or critical assets, usually addressed by Use a threat-informed SAFE-style architecture to map assets, zones, and security controls. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: A tabletop or controlled exercise restores protected service while containing the simulated threat.

Read credentials from an approved secret store or short-lived token service with least privilege. That action fits another problem: A Python script embeds a permanent security administrator API key in source code. It does not directly remediate the current finding at Linden Manufacturing: An automation script posts configuration updates to a firewall API without validating the HTTP response. The relevant corrective control for this case is: Check HTTP status, parse structured errors, and confirm device state after the request.

Iterate documented pagination links or continuation tokens until the bounded result set is exhausted. That action fits another problem: A script calls a paginated security events endpoint once and silently omits later pages. It does not directly remediate the current finding at Linden Manufacturing: An automation script posts configuration updates to a firewall API without validating the HTTP response. The relevant corrective control for this case is: Check HTTP status, parse structured errors, and confirm device state after the request.

Use supported idempotent operations or check for an existing resource before retrying writes. That action fits another problem: A script repeats a failed create request after a network timeout and generates duplicate security objects. It does not directly remediate the current finding at Linden Manufacturing: An automation script posts configuration updates to a firewall API without validating the HTTP response. The relevant corrective control for this case is: Check HTTP status, parse structured errors, and confirm device state after the request.

Source inspection finds no active secret and the intended API call succeeds under a scoped identity. This would be relevant evidence for a different failure: A Python script embeds a permanent security administrator API key in source code, usually addressed by Read credentials from an approved secret store or short-lived token service with least privilege. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A simulated 401 or 500 response is reported as failure and a successful change is read back.

The collected count matches the API's reported total without duplicate events. This would be relevant evidence for a different failure: A script calls a paginated security events endpoint once and silently omits later pages, usually addressed by Iterate documented pagination links or continuation tokens until the bounded result set is exhausted. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A simulated 401 or 500 response is reported as failure and a successful change is read back.

A timeout replay leaves one intended policy object and logs a definitive final state. This would be relevant evidence for a different failure: A script repeats a failed create request after a network timeout and generates duplicate security objects, usually addressed by Use supported idempotent operations or check for an existing resource before retrying writes. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A simulated 401 or 500 response is reported as failure and a successful change is read back.

Iterate documented pagination links or continuation tokens until the bounded result set is exhausted. That action fits another problem: A script calls a paginated security events endpoint once and silently omits later pages. It does not directly remediate the current finding at Lakeview Insurance: An automation script posts configuration updates to a firewall API without validating the HTTP response. The relevant corrective control for this case is: Check HTTP status, parse structured errors, and confirm device state after the request.

Validate response structure and handle missing fields and error codes explicitly. That action fits another problem: An orchestration script receives JSON from a firewall API but assumes a field is always present and crashes. It does not directly remediate the current finding at Lakeview Insurance: An automation script posts configuration updates to a firewall API without validating the HTTP response. The relevant corrective control for this case is: Check HTTP status, parse structured errors, and confirm device state after the request.

Use the documented HTTP method and schema and validate desired operation before execution. That action fits another problem: A security automation calls a REST endpoint with GET to perform a state change and ignores the documented API semantics. It does not directly remediate the current finding at Lakeview Insurance: An automation script posts configuration updates to a firewall API without validating the HTTP response. The relevant corrective control for this case is: Check HTTP status, parse structured errors, and confirm device state after the request.

An integration test confirms read calls cannot mutate resources and a correct write is audited. This would be relevant evidence for a different failure: A security automation calls a REST endpoint with GET to perform a state change and ignores the documented API semantics, usually addressed by Use the documented HTTP method and schema and validate desired operation before execution. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A simulated 401 or 500 response is reported as failure and a successful change is read back.

The collected count matches the API's reported total without duplicate events. This would be relevant evidence for a different failure: A script calls a paginated security events endpoint once and silently omits later pages, usually addressed by Iterate documented pagination links or continuation tokens until the bounded result set is exhausted. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A simulated 401 or 500 response is reported as failure and a successful change is read back.

A schema-change test fails safely with a useful diagnostic rather than applying an incorrect policy. This would be relevant evidence for a different failure: An orchestration script receives JSON from a firewall API but assumes a field is always present and crashes, usually addressed by Validate response structure and handle missing fields and error codes explicitly. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A simulated 401 or 500 response is reported as failure and a successful change is read back.