Question 250
Two partner sites negotiate IPsec but unexpectedly accept weak fallback suites with obsolete ciphers. Which response best addresses the central security requirement with a defensible, risk-based design?
- Allow any crypto suite so the tunnel always connects
- Replace strong IKE authentication with a shared spreadsheet secret
- Apply authenticated port/VLAN assignment and layer-3 access policies between segments
- Restrict IKE and ESP proposals to approved authenticated encryption, key exchange and lifetime profiles
Explanation
Correct Answer
D:Confidential tunnel negotiation can downgrade if permissive proposals remain.
Incorrect Answers
A:Availability through weak algorithms is not adequate security.
B:Unprotected keys undermine mutual authentication.
C:VLAN membership alone does not forbid inter-VLAN routing. Restrict IKE and ESP proposals to approved authenticated encryption, key exchange and lifetime profiles.
Question 251
A merger connects newly acquired company networks directly to internal production databases. Which response best addresses the central security requirement with a defensible, risk-based design?
- Place the acquired segment behind explicit trust boundaries with least-privilege allowlisted flows and monitored migration
- Validate IPsec traffic selectors, security associations, routing and protected subnets
- Change only subnet names while preserving unrestricted routes
- Open all internal ports until the merger ends
Explanation
Correct Answer
A:Merging routing domains does not imply mutual trust of assets or users.
Incorrect Answers
B:IKE negotiation alone does not prove correct packet encapsulation for the intended networks. Place the acquired segment behind explicit trust boundaries with least-privilege allowlisted flows and monitored migration.
C:Names do not enforce segmentation.
D:Broad access enables lateral movement.
Question 252
An internal microservice trusts any caller from the same Kubernetes cluster regardless of workload identity. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use a shared hardcoded API token for all pods
- Use authenticated service identities and authorization at application or service-mesh boundaries rather than relying on cluster location
- Treat namespace membership as automatic entitlement to every API
- Filter accepted prefixes and validate routing policy with origin/path protections where available
Explanation
Correct Answer
B:Zero trust service access requires explicit workload identity and policy.
Incorrect Answers
A:Shared secrets destroy isolation.
C:Logical placement alone is not authorization.
D:Routing control security constrains who can steer destinations. Use authenticated service identities and authorization at application or service-mesh boundaries rather than relying on cluster location.
Question 253
Employees join a rogue wireless AP that advertises the same corporate SSID as the official network. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use properly configured enterprise certificate-validated 802.1X authentication and rogue AP detection
- Disable server certificate checks to ease roaming
- Trust every AP that broadcasts the correct SSID
- Filter accepted prefixes and validate routing policy with origin/path protections where available
Explanation
Correct Answer
A:SSID matching is not server authenticity.
Incorrect Answers
B:Without validation an evil twin can capture credentials.
C:Attackers can copy an SSID.
D:Routing control security constrains who can steer destinations. Use properly configured enterprise certificate-validated 802.1X authentication and rogue AP detection.
Question 254
A cloud network controller API can reprogram tenant routing but uses one shared token for every administrator. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate IPsec traffic selectors, security associations, routing and protected subnets
- Expose the controller API to the public Internet without access restrictions
- Rely on switch port security alone to protect controller APIs
- Protect the controller control plane with strong per-admin authentication, scoped authorization and immutable configuration audit
Explanation
Correct Answer
D:Centralized SDN control creates a high-impact management target.
Incorrect Answers
A:IKE negotiation alone does not prove correct packet encapsulation for the intended networks. Protect the controller control plane with strong per-admin authentication, scoped authorization and immutable configuration audit.
B:Unbounded access makes topology manipulation easier.
C:Port controls do not authenticate controller callers.
Question 255
After a prior vlan finding, a regulated financial institution reports that the approved safeguard is implemented: “Apply authenticated port/VLAN assignment and layer-3 access policies between segments.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Inject a nonapproved route in a lab and confirm the route is rejected
- Trace trunk and inter-VLAN routing permissions with a forbidden test flow
- Use the completion of this alternative as proof: Assume different VLAN numbers enforce all traffic isolation
- Accept a signed change ticket saying: Apply authenticated port/VLAN assignment and layer-3 access policies between segments
Explanation
Correct Answer
B:Actual forwarding policy matters more than VLAN naming.
Incorrect Answers
A:Inbound route policy must be exercised. It tests routing, while this case requires evidence about vlan.
C:A router may forward between VLANs. Trace trunk and inter-VLAN routing permissions with a forbidden test flow.
D:Trace trunk and inter-VLAN routing permissions with a forbidden test flow. Actual forwarding policy matters more than VLAN naming.
Question 256
After a prior routing finding, a global logistics firm reports that the approved safeguard is implemented: “Filter accepted prefixes and validate routing policy with origin/path protections where available.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Inject a nonapproved route in a lab and confirm the route is rejected
- Accept a signed change ticket saying: Filter accepted prefixes and validate routing policy with origin/path protections where available
- Use the completion of this alternative as proof: Trust all partner advertisements by default
- Run this adjacent but different test as the sole proof: Revoke user trust and test immediate denial to sensitive resources
Explanation
Correct Answer
A:Inbound route policy must be exercised.
Incorrect Answers
B:Inject a nonapproved route in a lab and confirm the route is rejected. Inbound route policy must be exercised.
C:A misconfigured peer can leak or hijack routes. Inject a nonapproved route in a lab and confirm the route is rejected.
D:Context-sensitive evaluation must affect live access. It tests zero trust network, while this case requires evidence about routing.
Question 257
After a prior egress finding, a regional hospital network reports that the approved safeguard is implemented: “Apply controlled egress policies, approved destinations and telemetry appropriate to data sensitivity.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Test translation, DNS synthesis and return routing with a controlled legacy target
- Accept a signed change ticket saying: Apply controlled egress policies, approved destinations and telemetry appropriate to data sensitivity
- Use the completion of this alternative as proof: Focus exclusively on inbound port scanning
- Attempt a restricted upload and confirm policy block with auditable evidence
Explanation
Correct Answer
D:Egress tests measure enforceable destinations and data policy.
Incorrect Answers
A:Dual-stack transition needs complete protocol-path evidence. It tests ipv4/ipv6, while this case requires evidence about egress.
B:Attempt a restricted upload and confirm policy block with auditable evidence. Egress tests measure enforceable destinations and data policy.
C:Inbound filtering misses outbound theft. Attempt a restricted upload and confirm policy block with auditable evidence.
Question 258
After a prior traffic monitoring finding, a payment-services company reports that the approved safeguard is implemented: “Correlate network flow data, DNS and identity events under synchronized timestamps.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume total interface bytes identify a malicious caller
- Accept a signed change ticket saying: Correlate network flow data, DNS and identity events under synchronized timestamps
- Reconstruct a controlled test connection across sensors and systems
- Run this adjacent but different test as the sole proof: Revoke one user's credential and verify others remain connected
Explanation
Correct Answer
C:Event correlation tests monitoring completeness.
Incorrect Answers
A:Aggregate utilization lacks per-flow attribution. Reconstruct a controlled test connection across sensors and systems.
B:Reconstruct a controlled test connection across sensors and systems. Event correlation tests monitoring completeness.
D:Targeted revocation tests individual identity. It tests wireless, while this case requires evidence about traffic monitoring.
Question 259
After a prior osi/tcp-ip finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Isolate transport reachability and handshake state before testing TLS application authentication.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Capture packet-level SYN and response evidence at each relevant hop
- Use the completion of this alternative as proof: Renew every certificate before checking port reachability
- Run this adjacent but different test as the sole proof: Revoke user trust and test immediate denial to sensitive resources
- Accept a signed change ticket saying: Isolate transport reachability and handshake state before testing TLS application authentication
Explanation
Correct Answer
A:Layer-specific evidence avoids a misleading application diagnosis.
Incorrect Answers
B:A certificate change cannot fix a missing TCP path. Capture packet-level SYN and response evidence at each relevant hop.
C:Context-sensitive evaluation must affect live access. It tests zero trust network, while this case requires evidence about osi/tcp-ip.
D:Capture packet-level SYN and response evidence at each relevant hop. Layer-specific evidence avoids a misleading application diagnosis.
Question 260
After a prior ipv4/ipv6 finding, an international retailer reports that the approved safeguard is implemented: “Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume an IPv6 default gateway translates every IPv4 packet
- Test translation, DNS synthesis and return routing with a controlled legacy target
- Run this adjacent but different test as the sole proof: Attempt an invalid-name and untrusted-chain connection and verify rejection
- Accept a signed change ticket saying: Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate
Explanation
Correct Answer
B:Dual-stack transition needs complete protocol-path evidence.
Incorrect Answers
A:Ordinary routing does not perform protocol translation. Test translation, DNS synthesis and return routing with a controlled legacy target.
C:Negative tests demonstrate secure TLS trust evaluation. It tests tls, while this case requires evidence about ipv4/ipv6.
D:Test translation, DNS synthesis and return routing with a controlled legacy target. Dual-stack transition needs complete protocol-path evidence.
Certified Information Systems Security Professional (CISSP) Practice Tests