Exam Bundle

The VPN remains established through NAT with reliable bidirectional protected flows. This would be relevant evidence for a different failure: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address, usually addressed by Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

IKE establishes successfully and logs show compatible negotiated parameters. This would be relevant evidence for a different failure: An FTD site-to-site VPN shows no active IKE security association despite route reachability, usually addressed by Inspect IKE proposals, peer identity, authentication, and exchange logs before changing data-plane policy. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

Negotiation succeeds with the current credential while the old PSK remains invalid. This would be relevant evidence for a different failure: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation, usually addressed by Check secure peer key agreement and effective authentication profile on both sides. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. That action fits another problem: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. It does not directly remediate the current finding at Horizon Energy Services: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. The relevant corrective control for this case is: Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model.

Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. That action fits another problem: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. It does not directly remediate the current finding at Horizon Energy Services: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. The relevant corrective control for this case is: Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model.

Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. That action fits another problem: A virtual machine owner assumes the IaaS provider patches guest operating systems. It does not directly remediate the current finding at Horizon Energy Services: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. The relevant corrective control for this case is: Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model.

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure.

Document customer accountability for data classification, lawful processing, and chosen configurations. That action fits another problem: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. It does not directly remediate the current finding at Newbridge Charity: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. The relevant corrective control for this case is: Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model.

Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. That action fits another problem: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. It does not directly remediate the current finding at Newbridge Charity: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. The relevant corrective control for this case is: Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model.

Enforce customer-owned access controls, encryption choices, and bucket exposure policies. That action fits another problem: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. It does not directly remediate the current finding at Newbridge Charity: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. The relevant corrective control for this case is: Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model.

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure.

Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. That action fits another problem: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. It does not directly remediate the current finding at Harbor Point Medical: A virtual machine owner assumes the IaaS provider patches guest operating systems. The relevant corrective control for this case is: Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities.

Document customer accountability for data classification, lawful processing, and chosen configurations. That action fits another problem: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. It does not directly remediate the current finding at Harbor Point Medical: A virtual machine owner assumes the IaaS provider patches guest operating systems. The relevant corrective control for this case is: Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities.

Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. That action fits another problem: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. It does not directly remediate the current finding at Harbor Point Medical: A virtual machine owner assumes the IaaS provider patches guest operating systems. The relevant corrective control for this case is: Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned.

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned.

Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. That action fits another problem: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. It does not directly remediate the current finding at Clearbrook University: A virtual machine owner assumes the IaaS provider patches guest operating systems. The relevant corrective control for this case is: Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities.

Enforce customer-owned access controls, encryption choices, and bucket exposure policies. That action fits another problem: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. It does not directly remediate the current finding at Clearbrook University: A virtual machine owner assumes the IaaS provider patches guest operating systems. The relevant corrective control for this case is: Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities.

Document customer accountability for data classification, lawful processing, and chosen configurations. That action fits another problem: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. It does not directly remediate the current finding at Clearbrook University: A virtual machine owner assumes the IaaS provider patches guest operating systems. The relevant corrective control for this case is: Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned.

A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure. This would be relevant evidence for a different failure: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities, usually addressed by Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned.

Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. That action fits another problem: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. It does not directly remediate the current finding at Oceanview Payments: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. The relevant corrective control for this case is: Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration.

Document customer accountability for data classification, lawful processing, and chosen configurations. That action fits another problem: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. It does not directly remediate the current finding at Oceanview Payments: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. The relevant corrective control for this case is: Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration.

Enforce customer-owned access controls, encryption choices, and bucket exposure policies. That action fits another problem: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. It does not directly remediate the current finding at Oceanview Payments: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. The relevant corrective control for this case is: Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration.

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.