Question 260
After a prior ipv4/ipv6 finding, an international retailer reports that the approved safeguard is implemented: “Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume an IPv6 default gateway translates every IPv4 packet
- Test translation, DNS synthesis and return routing with a controlled legacy target
- Run this adjacent but different test as the sole proof: Attempt an invalid-name and untrusted-chain connection and verify rejection
- Accept a signed change ticket saying: Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate
Explanation
Correct Answer
B:Dual-stack transition needs complete protocol-path evidence.
Incorrect Answers
A:Ordinary routing does not perform protocol translation. Test translation, DNS synthesis and return routing with a controlled legacy target.
C:Negative tests demonstrate secure TLS trust evaluation. It tests tls, while this case requires evidence about ipv4/ipv6.
D:Test translation, DNS synthesis and return routing with a controlled legacy target. Dual-stack transition needs complete protocol-path evidence.
Question 261
After a prior tls finding, a university consortium reports that the approved safeguard is implemented: “Validate chain, name, validity and revocation as appropriate for mutually authenticated secure sessions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Attempt a restricted upload and confirm policy block with auditable evidence
- Accept a signed change ticket saying: Validate chain, name, validity and revocation as appropriate for mutually authenticated secure sessions
- Use the completion of this alternative as proof: Treat a successful TCP connection as TLS identity validation
- Attempt an invalid-name and untrusted-chain connection and verify rejection
Explanation
Correct Answer
D:Negative tests demonstrate secure TLS trust evaluation.
Incorrect Answers
A:Egress tests measure enforceable destinations and data policy. It tests egress, while this case requires evidence about tls.
B:Attempt an invalid-name and untrusted-chain connection and verify rejection. Negative tests demonstrate secure TLS trust evaluation.
C:Transport establishment does not verify a certificate. Attempt an invalid-name and untrusted-chain connection and verify rejection.
Question 262
After a prior ipsec finding, a cloud service provider reports that the approved safeguard is implemented: “Validate IPsec traffic selectors, security associations, routing and protected subnets.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume IKE success guarantees all routes and selectors
- Inspect ESP counters and successfully transmit only intended subnets
- Accept a signed change ticket saying: Validate IPsec traffic selectors, security associations, routing and protected subnets
- Run this adjacent but different test as the sole proof: Attempt an unauthorized cross-segment connection and confirm denial
Explanation
Correct Answer
B:End-to-end protected flows validate IPsec policy.
Incorrect Answers
A:An established IKE SA can coexist with broken child SA policy. Inspect ESP counters and successfully transmit only intended subnets.
C:Inspect ESP counters and successfully transmit only intended subnets. End-to-end protected flows validate IPsec policy.
D:Negative reachability testing proves isolation. It tests segmentation, while this case requires evidence about ipsec.
Question 263
After a prior segmentation finding, a regulated financial institution reports that the approved safeguard is implemented: “Implement restrictive inter-segment policy with default-deny and approved application flows.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Add more VLAN names but permit all routing between them
- Run this adjacent but different test as the sole proof: Attempt unauthorized controller API changes and verify denial and alerting
- Attempt an unauthorized cross-segment connection and confirm denial
- Accept a signed change ticket saying: Implement restrictive inter-segment policy with default-deny and approved application flows
Explanation
Correct Answer
C:Negative reachability testing proves isolation.
Incorrect Answers
A:Logical labels alone do not isolate traffic. Attempt an unauthorized cross-segment connection and confirm denial.
B:Control-plane protection needs explicit tests. It tests sdn, while this case requires evidence about segmentation.
D:Attempt an unauthorized cross-segment connection and confirm denial. Negative reachability testing proves isolation.
Question 264
After a prior zero trust network finding, a global logistics firm reports that the approved safeguard is implemented: “Broker access per application based on identity, device posture and context instead of trusting network adjacency.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Attempt unauthorized controller API changes and verify denial and alerting
- Revoke user trust and test immediate denial to sensitive resources
- Accept a signed change ticket saying: Broker access per application based on identity, device posture and context instead of trusting network adjacency
- Use the completion of this alternative as proof: Treat possession of a VPN IP as permanent authorization
Explanation
Correct Answer
B:Context-sensitive evaluation must affect live access.
Incorrect Answers
A:Control-plane protection needs explicit tests. It tests sdn, while this case requires evidence about zero trust network.
C:Revoke user trust and test immediate denial to sensitive resources. Context-sensitive evaluation must affect live access.
D:Network address does not prove continued entitlement. Revoke user trust and test immediate denial to sensitive resources.
Question 265
After a prior wireless finding, a regional hospital network reports that the approved safeguard is implemented: “Move to WPA3-Enterprise or supported 802.1X per-user authentication and segmented authorization.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Attempt an unauthorized cross-segment connection and confirm denial
- Revoke one user's credential and verify others remain connected
- Accept a signed change ticket saying: Move to WPA3-Enterprise or supported 802.1X per-user authentication and segmented authorization
- Use the completion of this alternative as proof: Change the shared password only once a year
Explanation
Correct Answer
B:Targeted revocation tests individual identity.
Incorrect Answers
A:Negative reachability testing proves isolation. It tests segmentation, while this case requires evidence about wireless.
C:Revoke one user's credential and verify others remain connected. Targeted revocation tests individual identity.
D:Shared secrets remain difficult to revoke for one user. Revoke one user's credential and verify others remain connected.
Question 266
After a prior sdn finding, a payment-services company reports that the approved safeguard is implemented: “Harden and isolate the SDN controller with scoped authentication, changes and monitoring.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume control/data-plane separation automatically authenticates API callers
- Accept a signed change ticket saying: Harden and isolate the SDN controller with scoped authentication, changes and monitoring
- Attempt unauthorized controller API changes and verify denial and alerting
- Run this adjacent but different test as the sole proof: Attempt an invalid-name and untrusted-chain connection and verify rejection
Explanation
Correct Answer
C:Control-plane protection needs explicit tests.
Incorrect Answers
A:Logical separation is not authorization. Attempt unauthorized controller API changes and verify denial and alerting.
B:Attempt unauthorized controller API changes and verify denial and alerting. Control-plane protection needs explicit tests.
D:Negative tests demonstrate secure TLS trust evaluation. It tests tls, while this case requires evidence about sdn.
Question 267
An incident review documented this vlan exposure: Two departments are on different VLAN IDs but a switch trunks both with unrestricted router forwarding. The response team proposed only “Assume different VLAN numbers enforce all traffic isolation” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- A router may forward between VLANs.
- Logical separation is not authorization.
- Wide routing increases attack paths.
- A single flat domain destroys segmentation.
Explanation
Correct Answer
A:A router may forward between VLANs. The relevant alternative is a router may forward between VLANs.
Incorrect Answers
B:Logical separation is not authorization. The actual criticized measure is a router may forward between VLANs.
C:Wide routing increases attack paths. The actual criticized measure is a router may forward between VLANs.
D:A single flat domain destroys segmentation. The actual criticized measure is a router may forward between VLANs.
Question 268
An incident review documented this routing exposure: A network accepts unauthorized BGP prefixes from an external partner and traffic takes a suspicious path. The response team proposed only “Trust all partner advertisements by default” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Network address does not prove continued entitlement.
- Caching is unrelated to transport handshake failure.
- A misconfigured peer can leak or hijack routes.
- App secrets do not control routing.
Explanation
Correct Answer
C:A misconfigured peer can leak or hijack routes. The missing change involves a misconfigured peer can leak or hijack routes.
Incorrect Answers
A:Network address does not prove continued entitlement. That does not establish a misconfigured peer can leak or hijack routes.
B:Caching is unrelated to transport handshake failure. The actual criticized measure is a misconfigured peer can leak or hijack routes.
D:App secrets do not control routing. The actual criticized measure is a misconfigured peer can leak or hijack routes.
Question 269
An incident review documented this egress exposure: Sensitive workstations can upload any content to arbitrary public file-sharing sites. The response team proposed only “Focus exclusively on inbound port scanning” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Caching is unrelated to transport handshake failure.
- Logical labels alone do not isolate traffic.
- TLS hides content from simple port-based policies.
- Inbound filtering misses outbound theft.
Explanation
Correct Answer
D:Inbound filtering misses outbound theft. The relevant alternative is inbound filtering misses outbound theft.
Incorrect Answers
A:Caching is unrelated to transport handshake failure. The actual criticized measure is inbound filtering misses outbound theft.
B:Logical labels alone do not isolate traffic. That does not establish inbound filtering misses outbound theft.
C:TLS hides content from simple port-based policies. The actual criticized measure is inbound filtering misses outbound theft.
Question 270
An incident review documented this traffic monitoring exposure: A SOC has backbone bandwidth charts but cannot link suspicious flows to source and destination identities. The response team proposed only “Assume total interface bytes identify a malicious caller” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Aggregate utilization lacks per-flow attribution.
- Ordinary routing does not perform protocol translation.
- App secrets do not control routing.
- Correlation becomes unreliable.
Explanation
Correct Answer
A:Aggregate utilization lacks per-flow attribution. The relevant alternative is aggregate utilization lacks per-flow attribution.
Incorrect Answers
B:Ordinary routing does not perform protocol translation. That does not establish aggregate utilization lacks per-flow attribution.
C:App secrets do not control routing. The actual criticized measure is aggregate utilization lacks per-flow attribution.
D:This describes the limitation of a different proposed action (Store unsynchronized logs without timestamps); it does not identify the main defect in Assume total interface bytes identify a malicious caller.
Certified Information Systems Security Professional (CISSP) Practice Tests