Exam Bundle

External scanning cannot reach the origin directly while permitted users authenticate through secure access. This would be relevant evidence for a different failure: A company exposes an internal application directly to the Internet instead of using identity-aware private access, usually addressed by Use an approved Secure Private Access publishing model that avoids unnecessary public inbound exposure. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A managed compliant endpoint connects and an unmanaged endpoint is rejected.

A simulated connector failure leaves the private application reachable via another healthy path. This would be relevant evidence for a different failure: A private application is published through a connector without failover consideration and maintenance causes outages, usually addressed by Deploy connector redundancy appropriate to availability needs and monitor connector state. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A managed compliant endpoint connects and an unmanaged endpoint is rejected.

A contractor reaches the assigned portal but cannot access financial database endpoints. This would be relevant evidence for a different failure: Contractors are assigned to a group that inadvertently grants access to private financial databases, usually addressed by Limit Secure Private Access policy to approved groups, apps, and contextual conditions. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A managed compliant endpoint connects and an unmanaged endpoint is rejected.

Use an approved Secure Private Access publishing model that avoids unnecessary public inbound exposure. That action fits another problem: A company exposes an internal application directly to the Internet instead of using identity-aware private access. It does not directly remediate the current finding at Arborstone Tech: Users can access a private app from unmanaged devices despite a policy requiring device trust. The relevant corrective control for this case is: Add supported posture and identity conditions to Secure Private Access authorization.

Configure Cisco Secure Access Secure Private Access at the specific authorized application boundary. That action fits another problem: A company grants remote workers access to an entire RFC1918 network when they need only a payroll web application. It does not directly remediate the current finding at Arborstone Tech: Users can access a private app from unmanaged devices despite a policy requiring device trust. The relevant corrective control for this case is: Add supported posture and identity conditions to Secure Private Access authorization.

Check connector health, application definition, DNS, and identity policy before broadening access. That action fits another problem: A private application connector has been registered but a user cannot reach the internal app. It does not directly remediate the current finding at Arborstone Tech: Users can access a private app from unmanaged devices despite a policy requiring device trust. The relevant corrective control for this case is: Add supported posture and identity conditions to Secure Private Access authorization.

An authorized test user reaches the intended app while an unauthorized identity is denied. This would be relevant evidence for a different failure: A private application connector has been registered but a user cannot reach the internal app, usually addressed by Check connector health, application definition, DNS, and identity policy before broadening access. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A managed compliant endpoint connects and an unmanaged endpoint is rejected.

The employee opens payroll but scans of unrelated private subnets are unsuccessful. This would be relevant evidence for a different failure: A company grants remote workers access to an entire RFC1918 network when they need only a payroll web application, usually addressed by Configure Cisco Secure Access Secure Private Access at the specific authorized application boundary. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A managed compliant endpoint connects and an unmanaged endpoint is rejected.

External scanning cannot reach the origin directly while permitted users authenticate through secure access. This would be relevant evidence for a different failure: A company exposes an internal application directly to the Internet instead of using identity-aware private access, usually addressed by Use an approved Secure Private Access publishing model that avoids unnecessary public inbound exposure. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A managed compliant endpoint connects and an unmanaged endpoint is rejected.

Apply data loss prevention classification and content controls for upload actions. That action fits another problem: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. It does not directly remediate the current finding at Sapphire Data Systems: Employees paste confidential customer numbers into public generative AI sites from company browsers. The relevant corrective control for this case is: Configure DLP policy for sensitive identifiers on governed web and AI destinations.

Enforce trusted authorization and AI guardrails together with outbound data inspection. That action fits another problem: A third-party prompt asks an enterprise AI assistant to disclose internal secrets through browser upload. It does not directly remediate the current finding at Sapphire Data Systems: Employees paste confidential customer numbers into public generative AI sites from company browsers. The relevant corrective control for this case is: Configure DLP policy for sensitive identifiers on governed web and AI destinations.

Tune policy classification, severity, and event visibility without exposing protected content unnecessarily. That action fits another problem: DLP blocks legitimate encrypted uploads without showing analysts which sensitive pattern matched. It does not directly remediate the current finding at Sapphire Data Systems: Employees paste confidential customer numbers into public generative AI sites from company browsers. The relevant corrective control for this case is: Configure DLP policy for sensitive identifiers on governed web and AI destinations.

Analysts can justify an incident from safe metadata and approved uploads are no longer blocked. This would be relevant evidence for a different failure: DLP blocks legitimate encrypted uploads without showing analysts which sensitive pattern matched, usually addressed by Tune policy classification, severity, and event visibility without exposing protected content unnecessarily. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: A simulated restricted upload is blocked or reviewed while safe requests remain usable.

An exfiltration simulation fails and produces a reviewable security event. This would be relevant evidence for a different failure: A third-party prompt asks an enterprise AI assistant to disclose internal secrets through browser upload, usually addressed by Enforce trusted authorization and AI guardrails together with outbound data inspection. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: A simulated restricted upload is blocked or reviewed while safe requests remain usable.

A protected test document triggers the expected DLP event and a non-sensitive file passes. This would be relevant evidence for a different failure: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification, usually addressed by Apply data loss prevention classification and content controls for upload actions. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: A simulated restricted upload is blocked or reviewed while safe requests remain usable.

Apply data loss prevention classification and content controls for upload actions. That action fits another problem: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. It does not directly remediate the current finding at Eastport Research Hospital: Employees paste confidential customer numbers into public generative AI sites from company browsers. The relevant corrective control for this case is: Configure DLP policy for sensitive identifiers on governed web and AI destinations.

Narrow exceptions to specific users, destinations, and justified content classifications. That action fits another problem: A secure Internet gateway has DLP rules but exceptions are so broad that personal information leaves through approved sites. It does not directly remediate the current finding at Eastport Research Hospital: Employees paste confidential customer numbers into public generative AI sites from company browsers. The relevant corrective control for this case is: Configure DLP policy for sensitive identifiers on governed web and AI destinations.

Define AI use policies with destination trust, content controls, and monitoring appropriate to risk. That action fits another problem: A security team bans every AI destination rather than applying risk-based safeguards for approved work. It does not directly remediate the current finding at Eastport Research Hospital: Employees paste confidential customer numbers into public generative AI sites from company browsers. The relevant corrective control for this case is: Configure DLP policy for sensitive identifiers on governed web and AI destinations.

A protected test document triggers the expected DLP event and a non-sensitive file passes. This would be relevant evidence for a different failure: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification, usually addressed by Apply data loss prevention classification and content controls for upload actions. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: A simulated restricted upload is blocked or reviewed while safe requests remain usable.

Approved AI usage meets policy without transmitting protected information. This would be relevant evidence for a different failure: A security team bans every AI destination rather than applying risk-based safeguards for approved work, usually addressed by Define AI use policies with destination trust, content controls, and monitoring appropriate to risk. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: A simulated restricted upload is blocked or reviewed while safe requests remain usable.

A prohibited data transfer is stopped even when the destination is otherwise allowed. This would be relevant evidence for a different failure: A secure Internet gateway has DLP rules but exceptions are so broad that personal information leaves through approved sites, usually addressed by Narrow exceptions to specific users, destinations, and justified content classifications. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: A simulated restricted upload is blocked or reviewed while safe requests remain usable.

Tune policy classification, severity, and event visibility without exposing protected content unnecessarily. That action fits another problem: DLP blocks legitimate encrypted uploads without showing analysts which sensitive pattern matched. It does not directly remediate the current finding at Frostline Distribution: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. The relevant corrective control for this case is: Apply data loss prevention classification and content controls for upload actions.

Configure DLP policy for sensitive identifiers on governed web and AI destinations. That action fits another problem: Employees paste confidential customer numbers into public generative AI sites from company browsers. It does not directly remediate the current finding at Frostline Distribution: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. The relevant corrective control for this case is: Apply data loss prevention classification and content controls for upload actions.

Define AI use policies with destination trust, content controls, and monitoring appropriate to risk. That action fits another problem: A security team bans every AI destination rather than applying risk-based safeguards for approved work. It does not directly remediate the current finding at Frostline Distribution: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. The relevant corrective control for this case is: Apply data loss prevention classification and content controls for upload actions.

Analysts can justify an incident from safe metadata and approved uploads are no longer blocked. This would be relevant evidence for a different failure: DLP blocks legitimate encrypted uploads without showing analysts which sensitive pattern matched, usually addressed by Tune policy classification, severity, and event visibility without exposing protected content unnecessarily. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: A protected test document triggers the expected DLP event and a non-sensitive file passes.

A simulated restricted upload is blocked or reviewed while safe requests remain usable. This would be relevant evidence for a different failure: Employees paste confidential customer numbers into public generative AI sites from company browsers, usually addressed by Configure DLP policy for sensitive identifiers on governed web and AI destinations. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: A protected test document triggers the expected DLP event and a non-sensitive file passes.

Approved AI usage meets policy without transmitting protected information. This would be relevant evidence for a different failure: A security team bans every AI destination rather than applying risk-based safeguards for approved work, usually addressed by Define AI use policies with destination trust, content controls, and monitoring appropriate to risk. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: A protected test document triggers the expected DLP event and a non-sensitive file passes.

Narrow exceptions to specific users, destinations, and justified content classifications. That action fits another problem: A secure Internet gateway has DLP rules but exceptions are so broad that personal information leaves through approved sites. It does not directly remediate the current finding at Aster Mutual: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. The relevant corrective control for this case is: Apply data loss prevention classification and content controls for upload actions.

Define AI use policies with destination trust, content controls, and monitoring appropriate to risk. That action fits another problem: A security team bans every AI destination rather than applying risk-based safeguards for approved work. It does not directly remediate the current finding at Aster Mutual: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. The relevant corrective control for this case is: Apply data loss prevention classification and content controls for upload actions.

Enforce trusted authorization and AI guardrails together with outbound data inspection. That action fits another problem: A third-party prompt asks an enterprise AI assistant to disclose internal secrets through browser upload. It does not directly remediate the current finding at Aster Mutual: An organization allows file uploads to sanctioned SaaS but has no inspection for sensitive document classification. The relevant corrective control for this case is: Apply data loss prevention classification and content controls for upload actions.

Approved AI usage meets policy without transmitting protected information. This would be relevant evidence for a different failure: A security team bans every AI destination rather than applying risk-based safeguards for approved work, usually addressed by Define AI use policies with destination trust, content controls, and monitoring appropriate to risk. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A protected test document triggers the expected DLP event and a non-sensitive file passes.

An exfiltration simulation fails and produces a reviewable security event. This would be relevant evidence for a different failure: A third-party prompt asks an enterprise AI assistant to disclose internal secrets through browser upload, usually addressed by Enforce trusted authorization and AI guardrails together with outbound data inspection. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A protected test document triggers the expected DLP event and a non-sensitive file passes.

A prohibited data transfer is stopped even when the destination is otherwise allowed. This would be relevant evidence for a different failure: A secure Internet gateway has DLP rules but exceptions are so broad that personal information leaves through approved sites, usually addressed by Narrow exceptions to specific users, destinations, and justified content classifications. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A protected test document triggers the expected DLP event and a non-sensitive file passes.