Exam Bundle

The corrected matching policy grants only the authorized access type. This would be relevant evidence for a different failure: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords, usually addressed by Correlate identity, network device group, service, and policy evaluation before changing credentials. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A repeated test set authenticates reliably with the current secret and records accounting.

A test administrator authenticates through TACACS+ and the server logs the transaction. This would be relevant evidence for a different failure: A network device accepts local login but never reaches the configured TACACS+ server during administrator authentication, usually addressed by Verify AAA server reachability, source interface, shared secret, and method-list order. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A repeated test set authenticates reliably with the current secret and records accounting.

Logs identify the policy denial and allowed commands work for the approved role. This would be relevant evidence for a different failure: A user is repeatedly rejected for device administration despite successful directory authentication, usually addressed by Differentiate authentication failure from TACACS+ command authorization or accounting policy problems. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A repeated test set authenticates reliably with the current secret and records accounting.

Synchronize the RADIUS shared secrets and review timeout and retry configuration. That action fits another problem: RADIUS sessions fail intermittently because client and server shared secrets do not match after rotation. It does not directly remediate the current finding at Northbridge University: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords. The relevant corrective control for this case is: Correlate identity, network device group, service, and policy evaluation before changing credentials.

Differentiate authentication failure from TACACS+ command authorization or accounting policy problems. That action fits another problem: A user is repeatedly rejected for device administration despite successful directory authentication. It does not directly remediate the current finding at Northbridge University: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords. The relevant corrective control for this case is: Correlate identity, network device group, service, and policy evaluation before changing credentials.

Configure an appropriate source interface and allow the required AAA flow securely. That action fits another problem: A network device sends TACACS+ requests from an interface not permitted through the management firewall. It does not directly remediate the current finding at Northbridge University: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords. The relevant corrective control for this case is: Correlate identity, network device group, service, and policy evaluation before changing credentials.

Requests reach the intended AAA server from the approved source address. This would be relevant evidence for a different failure: A network device sends TACACS+ requests from an interface not permitted through the management firewall, usually addressed by Configure an appropriate source interface and allow the required AAA flow securely. It does not demonstrate that the current problem at Northbridge University was resolved. The specific required evidence is: The corrected matching policy grants only the authorized access type.

Logs identify the policy denial and allowed commands work for the approved role. This would be relevant evidence for a different failure: A user is repeatedly rejected for device administration despite successful directory authentication, usually addressed by Differentiate authentication failure from TACACS+ command authorization or accounting policy problems. It does not demonstrate that the current problem at Northbridge University was resolved. The specific required evidence is: The corrected matching policy grants only the authorized access type.

A repeated test set authenticates reliably with the current secret and records accounting. This would be relevant evidence for a different failure: RADIUS sessions fail intermittently because client and server shared secrets do not match after rotation, usually addressed by Synchronize the RADIUS shared secrets and review timeout and retry configuration. It does not demonstrate that the current problem at Northbridge University was resolved. The specific required evidence is: The corrected matching policy grants only the authorized access type.

Synchronize the RADIUS shared secrets and review timeout and retry configuration. That action fits another problem: RADIUS sessions fail intermittently because client and server shared secrets do not match after rotation. It does not directly remediate the current finding at Aspen Digital: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords. The relevant corrective control for this case is: Correlate identity, network device group, service, and policy evaluation before changing credentials.

Verify AAA server reachability, source interface, shared secret, and method-list order. That action fits another problem: A network device accepts local login but never reaches the configured TACACS+ server during administrator authentication. It does not directly remediate the current finding at Aspen Digital: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords. The relevant corrective control for this case is: Correlate identity, network device group, service, and policy evaluation before changing credentials.

Inspect the returned RADIUS attributes and the corresponding device policy mapping. That action fits another problem: RADIUS authentication succeeds but an access policy applies the wrong authorization attributes. It does not directly remediate the current finding at Aspen Digital: AAA debug logs show an unknown policy set and engineers incorrectly change user passwords. The relevant corrective control for this case is: Correlate identity, network device group, service, and policy evaluation before changing credentials.

A repeated test set authenticates reliably with the current secret and records accounting. This would be relevant evidence for a different failure: RADIUS sessions fail intermittently because client and server shared secrets do not match after rotation, usually addressed by Synchronize the RADIUS shared secrets and review timeout and retry configuration. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: The corrected matching policy grants only the authorized access type.

A test administrator authenticates through TACACS+ and the server logs the transaction. This would be relevant evidence for a different failure: A network device accepts local login but never reaches the configured TACACS+ server during administrator authentication, usually addressed by Verify AAA server reachability, source interface, shared secret, and method-list order. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: The corrected matching policy grants only the authorized access type.

An approved identity receives the correct VLAN or authorization profile. This would be relevant evidence for a different failure: RADIUS authentication succeeds but an access policy applies the wrong authorization attributes, usually addressed by Inspect the returned RADIUS attributes and the corresponding device policy mapping. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: The corrected matching policy grants only the authorized access type.

Validate peer certificate chains and hostnames for API and RESTCONF management calls. That action fits another problem: An automation client uses a certificate with the wrong server name yet ignores TLS errors. It does not directly remediate the current finding at Atlas Scientific: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. The relevant corrective control for this case is: Use SNMPv3 authPriv where supported and restrict manager addresses.

Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions. That action fits another problem: A network automation service modifies device configuration over an unauthenticated legacy protocol. It does not directly remediate the current finding at Atlas Scientific: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. The relevant corrective control for this case is: Use SNMPv3 authPriv where supported and restrict manager addresses.

Use SCP or SFTP to protected storage with least-privilege service credentials. That action fits another problem: Administrators transfer backups over unencrypted FTP to a shared server. It does not directly remediate the current finding at Atlas Scientific: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. The relevant corrective control for this case is: Use SNMPv3 authPriv where supported and restrict manager addresses.

An impostor certificate fails the test and a valid management endpoint succeeds. This would be relevant evidence for a different failure: An automation client uses a certificate with the wrong server name yet ignores TLS errors, usually addressed by Validate peer certificate chains and hostnames for API and RESTCONF management calls. It does not demonstrate that the current problem at Atlas Scientific was resolved. The specific required evidence is: A packet inspection shows protected monitoring traffic and a v2c attempt is rejected.

An authorized test changes only an approved configuration subtree and an untrusted client is denied. This would be relevant evidence for a different failure: A network automation service modifies device configuration over an unauthenticated legacy protocol, usually addressed by Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions. It does not demonstrate that the current problem at Atlas Scientific was resolved. The specific required evidence is: A packet inspection shows protected monitoring traffic and a v2c attempt is rejected.

A backup transfer is encrypted and stored with access and integrity controls. This would be relevant evidence for a different failure: Administrators transfer backups over unencrypted FTP to a shared server, usually addressed by Use SCP or SFTP to protected storage with least-privilege service credentials. It does not demonstrate that the current problem at Atlas Scientific was resolved. The specific required evidence is: A packet inspection shows protected monitoring traffic and a v2c attempt is rejected.

Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions. That action fits another problem: A network automation service modifies device configuration over an unauthenticated legacy protocol. It does not directly remediate the current finding at Orion Network Services: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. The relevant corrective control for this case is: Use SNMPv3 authPriv where supported and restrict manager addresses.

Limit management HTTPS to an approved admin network with strong authentication. That action fits another problem: A router permits HTTPS management from Internet addresses without IP-based or identity restrictions. It does not directly remediate the current finding at Orion Network Services: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. The relevant corrective control for this case is: Use SNMPv3 authPriv where supported and restrict manager addresses.

Use protected syslog transport and authenticated collectors according to supported capabilities. That action fits another problem: A security appliance's syslog packets cross an untrusted segment without integrity or confidentiality controls. It does not directly remediate the current finding at Orion Network Services: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. The relevant corrective control for this case is: Use SNMPv3 authPriv where supported and restrict manager addresses.

Untrusted clients cannot reach the interface and approved administrators can connect. This would be relevant evidence for a different failure: A router permits HTTPS management from Internet addresses without IP-based or identity restrictions, usually addressed by Limit management HTTPS to an approved admin network with strong authentication. It does not demonstrate that the current problem at Orion Network Services was resolved. The specific required evidence is: A packet inspection shows protected monitoring traffic and a v2c attempt is rejected.

The collector receives trustworthy events while a forged or unprotected feed is rejected. This would be relevant evidence for a different failure: A security appliance's syslog packets cross an untrusted segment without integrity or confidentiality controls, usually addressed by Use protected syslog transport and authenticated collectors according to supported capabilities. It does not demonstrate that the current problem at Orion Network Services was resolved. The specific required evidence is: A packet inspection shows protected monitoring traffic and a v2c attempt is rejected.

An authorized test changes only an approved configuration subtree and an untrusted client is denied. This would be relevant evidence for a different failure: A network automation service modifies device configuration over an unauthenticated legacy protocol, usually addressed by Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions. It does not demonstrate that the current problem at Orion Network Services was resolved. The specific required evidence is: A packet inspection shows protected monitoring traffic and a v2c attempt is rejected.

Use SCP or SFTP to protected storage with least-privilege service credentials. That action fits another problem: Administrators transfer backups over unencrypted FTP to a shared server. It does not directly remediate the current finding at Briarwood Property Group: A network automation service modifies device configuration over an unauthenticated legacy protocol. The relevant corrective control for this case is: Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions.

Use protected syslog transport and authenticated collectors according to supported capabilities. That action fits another problem: A security appliance's syslog packets cross an untrusted segment without integrity or confidentiality controls. It does not directly remediate the current finding at Briarwood Property Group: A network automation service modifies device configuration over an unauthenticated legacy protocol. The relevant corrective control for this case is: Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions.

Use SNMPv3 authPriv where supported and restrict manager addresses. That action fits another problem: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths. It does not directly remediate the current finding at Briarwood Property Group: A network automation service modifies device configuration over an unauthenticated legacy protocol. The relevant corrective control for this case is: Adopt authenticated, encrypted NETCONF or RESTCONF transport with role-specific permissions.

A backup transfer is encrypted and stored with access and integrity controls. This would be relevant evidence for a different failure: Administrators transfer backups over unencrypted FTP to a shared server, usually addressed by Use SCP or SFTP to protected storage with least-privilege service credentials. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: An authorized test changes only an approved configuration subtree and an untrusted client is denied.

A packet inspection shows protected monitoring traffic and a v2c attempt is rejected. This would be relevant evidence for a different failure: Monitoring credentials are sent in plaintext SNMPv2c strings across untrusted paths, usually addressed by Use SNMPv3 authPriv where supported and restrict manager addresses. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: An authorized test changes only an approved configuration subtree and an untrusted client is denied.

The collector receives trustworthy events while a forged or unprotected feed is rejected. This would be relevant evidence for a different failure: A security appliance's syslog packets cross an untrusted segment without integrity or confidentiality controls, usually addressed by Use protected syslog transport and authenticated collectors according to supported capabilities. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: An authorized test changes only an approved configuration subtree and an untrusted client is denied.