Question 280
An edge router accepts unauthorized BGP prefixes from a transit peer and diverts client traffic. Which response best addresses the central security requirement with a defensible, risk-based design?
- Design diversity and independence for critical network paths and test failover
- Accept every route from any adjacent peer
- Apply accepted prefix filtering, max-prefix limits and suitable routing security controls at the peer boundary
- Increase link bandwidth to fix route origin trust
Explanation
Correct Answer
C:Route exchange needs policy validation to limit accidental or malicious announcements.
Incorrect Answers
A:Redundancy without common-mode analysis can fail simultaneously. Apply accepted prefix filtering, max-prefix limits and suitable routing security controls at the peer boundary.
B:Unrestricted announcements enable leaks and hijack paths.
D:Capacity does not validate reachability information.
Question 281
Unmanaged contractor laptops can join the internal office Ethernet without health or identity checks. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require network access control identity and device posture decisions with restricted onboarding networks
- Trust the wall jack as an employee identity
- Disable endpoint posture checks whenever the lobby is busy
- Use DHCP snooping on untrusted access ports and limit authorized server paths
Explanation
Correct Answer
A:Wired physical access should not automatically grant production VLAN access.
Incorrect Answers
B:Jack location does not identify the endpoint.
C:Operations convenience widens exposure.
D:Switch protections constrain address assignment attacks at layer two. Require network access control identity and device posture decisions with restricted onboarding networks.
Question 282
A SOC installs EDR only on some endpoints and cannot investigate a newly compromised unmanaged server. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply network access control with authenticated device/user identity and posture-based segment assignment
- Enforce sensor enrollment coverage with health monitoring and controlled exceptions
- Assume antivirus installed years ago still reports correctly
- Count purchased endpoint licenses as deployed coverage
Explanation
Correct Answer
B:Detection capability depends on deployment and active telemetry.
Incorrect Answers
A:NAC can make admission conditional rather than blindly trusting physical connection. Enforce sensor enrollment coverage with health monitoring and controlled exceptions.
C:Stale agents may stop sending telemetry.
D:Licenses do not guarantee working sensors.
Question 283
After a prior transmission media finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Evaluate fiber or protected transmission routes with physical security and encryption.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Inspect route security and validate encrypted transmission performance
- Accept a signed change ticket saying: Evaluate fiber or protected transmission routes with physical security and encryption
- Use the completion of this alternative as proof: Assume ordinary copper conduit guarantees confidentiality
- Run this adjacent but different test as the sole proof: Disable one router and power feed and measure traffic continuity
Explanation
Correct Answer
A:Both physical and logical evidence matter.
Incorrect Answers
B:Inspect route security and validate encrypted transmission performance. Both physical and logical evidence matter.
C:Physical cable shielding does not encrypt content. Inspect route security and validate encrypted transmission performance.
D:Independent failure testing validates resilience. It tests redundant devices, while this case requires evidence about transmission media.
Question 284
Two firewalls form an HA pair but both use the same failed power distribution unit. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume heartbeat state means power redundancy is adequate
- Add a third firewall to the same single PDU
- Separate the HA members across independent power and relevant failure domains
- Use DHCP snooping on untrusted access ports and limit authorized server paths
Explanation
Correct Answer
C:Device duplication does not remove correlated dependencies.
Incorrect Answers
A:Heartbeat does not identify shared infrastructure.
B:A shared power loss can take all three down.
D:Switch protections constrain address assignment attacks at layer two. Separate the HA members across independent power and relevant failure domains.
Question 285
After a prior switches and routers finding, a university consortium reports that the approved safeguard is implemented: “Use DHCP snooping on untrusted access ports and limit authorized server paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Rely only on endpoint DNS settings
- Connect a test rogue DHCP server and confirm client traffic is not redirected
- Accept a signed change ticket saying: Use DHCP snooping on untrusted access ports and limit authorized server paths
- Run this adjacent but different test as the sole proof: Stop the sensor in a test and confirm an actionable central alert
Explanation
Correct Answer
B:A realistic rogue offer validates enforcement.
Incorrect Answers
A:DNS configuration does not block rogue DHCP offers. Connect a test rogue DHCP server and confirm client traffic is not redirected.
C:Connect a test rogue DHCP server and confirm client traffic is not redirected. A realistic rogue offer validates enforcement.
D:Tamper tests reveal monitoring blind spots. It tests endpoint agents, while this case requires evidence about switches and routers.
Question 286
After a prior nac finding, a cloud service provider reports that the approved safeguard is implemented: “Apply network access control with authenticated device/user identity and posture-based segment assignment.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Connect noncompliant and compliant endpoints and compare allowed access
- Use the completion of this alternative as proof: Treat an Ethernet cable as sufficient authorization
- Accept a signed change ticket saying: Apply network access control with authenticated device/user identity and posture-based segment assignment
- Run this adjacent but different test as the sole proof: Inspect route security and validate encrypted transmission performance
Explanation
Correct Answer
A:Posture-based tests show admission decisions.
Incorrect Answers
B:Physical link does not establish endpoint trust. Connect noncompliant and compliant endpoints and compare allowed access.
C:Connect noncompliant and compliant endpoints and compare allowed access. Posture-based tests show admission decisions.
D:Both physical and logical evidence matter. It tests transmission media, while this case requires evidence about nac.
Question 287
After a prior endpoint agents finding, a regulated financial institution reports that the approved safeguard is implemented: “Protect endpoint agent tamper controls and detect stale or missing telemetry.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Count installed licenses only
- Stop the sensor in a test and confirm an actionable central alert
- Run this adjacent but different test as the sole proof: Disable one router and power feed and measure traffic continuity
- Accept a signed change ticket saying: Protect endpoint agent tamper controls and detect stale or missing telemetry
Explanation
Correct Answer
B:Tamper tests reveal monitoring blind spots.
Incorrect Answers
A:A license does not show an agent is active. Stop the sensor in a test and confirm an actionable central alert.
C:Independent failure testing validates resilience. It tests redundant devices, while this case requires evidence about endpoint agents.
D:Stop the sensor in a test and confirm an actionable central alert. Tamper tests reveal monitoring blind spots.
Question 288
An incident review documented this transmission media exposure: A secure office sends a sensitive link over copper between buildings exposed to electromagnetic interference and tapping. The response team proposed only “Assume ordinary copper conduit guarantees confidentiality” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Naming networks guest does not enforce NAC.
- Physical cable shielding does not encrypt content.
- Unprotected radio expands exposure.
- DNS configuration does not block rogue DHCP offers.
Explanation
Correct Answer
B:Physical cable shielding does not encrypt content. The missing change involves physical cable shielding does not encrypt content.
Incorrect Answers
A:Naming networks guest does not enforce NAC. The actual criticized measure is physical cable shielding does not encrypt content.
C:This describes the limitation of a different proposed action (Use Wi-Fi without authentication for the same sensitive link); it does not identify the main defect in Assume ordinary copper conduit guarantees confidentiality.
D:DNS configuration does not block rogue DHCP offers. That does not establish physical cable shielding does not encrypt content.
Question 289
After a prior redundant devices finding, a regional hospital network reports that the approved safeguard is implemented: “Design diversity and independence for critical network paths and test failover.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Count interfaces without checking upstream dependencies
- Run this adjacent but different test as the sole proof: Connect noncompliant and compliant endpoints and compare allowed access
- Disable one router and power feed and measure traffic continuity
- Accept a signed change ticket saying: Design diversity and independence for critical network paths and test failover
Explanation
Correct Answer
C:Independent failure testing validates resilience.
Incorrect Answers
A:Multiple ports can share one failure domain. Disable one router and power feed and measure traffic continuity.
B:Posture-based tests show admission decisions. It tests nac, while this case requires evidence about redundant devices.
D:Disable one router and power feed and measure traffic continuity. Independent failure testing validates resilience.
Question 290
An incident review documented this switches and routers exposure: An edge router accepts unauthorized BGP prefixes from a transit peer and diverts client traffic. The response team proposed only “Accept every route from any adjacent peer” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Capacity does not validate reachability information.
- Unrestricted announcements enable leaks and hijack paths.
- Multiple ports can share one failure domain.
- Uncontrolled disablement defeats the control.
Explanation
Correct Answer
B:Unrestricted announcements enable leaks and hijack paths. The missing change involves unrestricted announcements enable leaks and hijack paths.
Incorrect Answers
A:Capacity does not validate reachability information. The actual criticized measure is unrestricted announcements enable leaks and hijack paths.
C:Multiple ports can share one failure domain. That does not establish unrestricted announcements enable leaks and hijack paths.
D:Uncontrolled disablement defeats the control. The actual criticized measure is unrestricted announcements enable leaks and hijack paths.
Certified Information Systems Security Professional (CISSP) Practice Tests