Question 300
An external support vendor requests a permanent tunnel that routes its entire corporate network to production. Which response best addresses the central security requirement with a defensible, risk-based design?
- Advertise all production CIDRs without review
- Rely on a vendor contract with no technical route restriction
- Scope third-party VPN routes and firewall policies to necessary destinations, identities and review periods
- Use authenticated meeting admission, end-to-end encryption where available and controlled recordings
Explanation
Correct Answer
C:A tunnel should not become unrestricted mutual network trust.
Incorrect Answers
A:Broad routes enlarge the vendor blast radius.
B:Contracts do not enforce packet access.
D:Real-time media confidentiality depends on participant trust as well as encryption. Scope third-party VPN routes and firewall policies to necessary destinations, identities and review periods.
Question 301
A company needs branch-to-headquarters VPN but uses a tunnel that fails whenever an IP address changes. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use authenticated meeting admission, end-to-end encryption where available and controlled recordings
- Switch sensitive traffic to plaintext whenever a carrier fails
- Disable tunnel authentication so any new IP is accepted
- Configure supported certificate-based or dynamically negotiated peer identity and resilient failover where appropriate
Explanation
Correct Answer
D:A rigid peer-IP assumption can impair availability during carrier changes.
Incorrect Answers
A:Real-time media confidentiality depends on participant trust as well as encryption. Configure supported certificate-based or dynamically negotiated peer identity and resilient failover where appropriate.
B:Availability cannot bypass confidentiality obligations.
C:Untrusted peers must still be authenticated.
Question 302
Network administrators SSH directly into hundreds of production switches using a shared password. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use an authenticated audited privileged access gateway with individual accounts and session accountability
- Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links
- Keep the password on a shared wiki
- Change the shared password only after someone leaves
Explanation
Correct Answer
A:Shared direct credentials prevent attribution and complicate revocation.
Incorrect Answers
B:Constrained media can cause latency and availability problems while still needing security. Use an authenticated audited privileged access gateway with individual accounts and session accountability.
C:Broad secret distribution increases compromise.
D:Periodic rotation does not establish identity attribution.
Question 303
After a prior satellite/backhaul finding, a regulated financial institution reports that the approved safeguard is implemented: “Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links
- Run this adjacent but different test as the sole proof: Revoke one employee and verify their remote access and active sessions terminate
- Use the completion of this alternative as proof: Assume satellite links cannot be intercepted due to altitude
- Run representative high-latency outage tests on critical transactions
Explanation
Correct Answer
D:Operational validation reveals backhaul constraints.
Incorrect Answers
A:Run representative high-latency outage tests on critical transactions. Operational validation reveals backhaul constraints.
B:Identity and session lifecycle must be enforceable. It tests remote access, while this case requires evidence about satellite/backhaul.
C:Radio transmissions require cryptographic protection. Run representative high-latency outage tests on critical transactions.
Question 304
After a prior remote access finding, a global logistics firm reports that the approved safeguard is implemented: “Require individual phishing-resistant authentication, device checks and narrowly scoped sessions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Verify negotiated algorithms, peer authentication and revocation on each tunnel
- Accept a signed change ticket saying: Require individual phishing-resistant authentication, device checks and narrowly scoped sessions
- Use the completion of this alternative as proof: Trust every user after possession of a shared VPN password
- Revoke one employee and verify their remote access and active sessions terminate
Explanation
Correct Answer
D:Identity and session lifecycle must be enforceable.
Incorrect Answers
A:Handshake telemetry validates actual VPN strength. It tests vpn, while this case requires evidence about remote access.
B:Revoke one employee and verify their remote access and active sessions terminate. Identity and session lifecycle must be enforceable.
C:Shared credentials defeat accountability and selective revocation. Revoke one employee and verify their remote access and active sessions terminate.
Question 305
After a prior voice/video finding, a regional hospital network reports that the approved safeguard is implemented: “Use authenticated meeting admission, end-to-end encryption where available and controlled recordings.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Verify negotiated algorithms, peer authentication and revocation on each tunnel
- Attempt entry with an uninvited identity and verify denial and recording restrictions
- Accept a signed change ticket saying: Use authenticated meeting admission, end-to-end encryption where available and controlled recordings
- Use the completion of this alternative as proof: Assume transport encryption stops invited-but-unauthorized attendees
Explanation
Correct Answer
B:The actual collaboration access path must be tested.
Incorrect Answers
A:Handshake telemetry validates actual VPN strength. It tests vpn, while this case requires evidence about voice/video.
C:Attempt entry with an uninvited identity and verify denial and recording restrictions. The actual collaboration access path must be tested.
D:An authenticated channel does not authorize all participants. Attempt entry with an uninvited identity and verify denial and recording restrictions.
Question 306
After a prior third-party tunnels finding, a payment-services company reports that the approved safeguard is implemented: “Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths
- Use the completion of this alternative as proof: Permit all partner prefixes because IPsec is encrypted
- Test nonapproved partner subnets and verify they have no route into production
- Run this adjacent but different test as the sole proof: Attempt legacy cleartext login and verify disabled, then audit authorized SSH actions
Explanation
Correct Answer
C:Partner isolation requires negative reachability evidence.
Incorrect Answers
A:Test nonapproved partner subnets and verify they have no route into production. Partner isolation requires negative reachability evidence.
B:Encryption does not constrain which internal networks are reachable. Test nonapproved partner subnets and verify they have no route into production.
D:Management-plane hardening must be enforced end to end. It tests administrative access, while this case requires evidence about third-party tunnels.
Question 307
After a prior vpn finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Deploy modern authenticated VPN profiles with per-peer credentials and strong algorithms.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Deploy modern authenticated VPN profiles with per-peer credentials and strong algorithms
- Run this adjacent but different test as the sole proof: Run representative high-latency outage tests on critical transactions
- Use the completion of this alternative as proof: Keep the weak secret because the network is private
- Verify negotiated algorithms, peer authentication and revocation on each tunnel
Explanation
Correct Answer
D:Handshake telemetry validates actual VPN strength.
Incorrect Answers
A:Verify negotiated algorithms, peer authentication and revocation on each tunnel. Handshake telemetry validates actual VPN strength.
B:Operational validation reveals backhaul constraints. It tests satellite/backhaul, while this case requires evidence about vpn.
C:Shared key compromise can expose sessions. Verify negotiated algorithms, peer authentication and revocation on each tunnel.
Question 308
After a prior administrative access finding, an international retailer reports that the approved safeguard is implemented: “Use individually attributable SSH or equivalent secure management with centralized AAA and least privilege.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Verify negotiated algorithms, peer authentication and revocation on each tunnel
- Accept a signed change ticket saying: Use individually attributable SSH or equivalent secure management with centralized AAA and least privilege
- Attempt legacy cleartext login and verify disabled, then audit authorized SSH actions
- Use the completion of this alternative as proof: Keep Telnet and hide it on another port
Explanation
Correct Answer
C:Management-plane hardening must be enforced end to end.
Incorrect Answers
A:Handshake telemetry validates actual VPN strength. It tests vpn, while this case requires evidence about administrative access.
B:Attempt legacy cleartext login and verify disabled, then audit authorized SSH actions. Management-plane hardening must be enforced end to end.
D:Port changes do not add encryption. Attempt legacy cleartext login and verify disabled, then audit authorized SSH actions.
Question 309
An incident review documented this satellite/backhaul exposure: A remote field office depends on a high-latency satellite backhaul for authentication and monitoring. The response team proposed only “Assume satellite links cannot be intercepted due to altitude” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Open administration interfaces invite exploitation.
- Improper thresholds create false failures.
- An authenticated channel does not authorize all participants.
- Radio transmissions require cryptographic protection.
Explanation
Correct Answer
D:Radio transmissions require cryptographic protection. The relevant alternative is radio transmissions require cryptographic protection.
Incorrect Answers
A:Open administration interfaces invite exploitation. The actual criticized measure is radio transmissions require cryptographic protection.
B:Improper thresholds create false failures. The actual criticized measure is radio transmissions require cryptographic protection.
C:An authenticated channel does not authorize all participants. That does not establish radio transmissions require cryptographic protection.
Question 310
An incident review documented this remote access exposure: Remote administrators authenticate to a VPN with passwords that have been repeatedly phished. The response team proposed only “Increase password length alone and retain password-only VPN” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Source IP does not prove user identity.
- Post-call disclosure defeats confidentiality.
- Radio transmissions require cryptographic protection.
- Stronger passwords can still be phished.
Explanation
Correct Answer
D:Stronger passwords can still be phished. The relevant alternative is stronger passwords can still be phished.
Incorrect Answers
A:Source IP does not prove user identity. The actual criticized measure is stronger passwords can still be phished.
B:This describes the unrelated voice/video decision rather than the named faulty measure Increase password length alone and retain password-only VPN.
C:Cryptographic protection of radio transmissions addresses wireless confidentiality, but it does not eliminate phishing of VPN passwords; phishing-resistant authentication is needed.
Certified Information Systems Security Professional (CISSP) Practice Tests