Question 370
After a prior dac finding, a payment-services company reports that the approved safeguard is implemented: “Use discretionary access controls where owners can grant permitted rights under organizational constraints.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Use discretionary access controls where owners can grant permitted rights under organizational constraints
- Use the completion of this alternative as proof: Treat all files as centrally immutable mandatory labels
- Have an authorized owner grant and revoke access and verify changes
- Run this adjacent but different test as the sole proof: Probe direct and brokered paths with disallowed identity
Explanation
Correct Answer
C:Owner-based permissions should be effective and auditable.
Incorrect Answers
A:Have an authorized owner grant and revoke access and verify changes. Owner-based permissions should be effective and auditable.
B:Mandatory policy is different from owner discretion. Have an authorized owner grant and revoke access and verify changes.
D:Bypass detection validates enforcement coverage. It tests policy decision/enforcement, while this case requires evidence about dac.
Question 371
After a prior risk-based access finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Step up authentication or restrict the session based on evaluated risk signals.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Step up authentication or restrict the session based on evaluated risk signals
- Use the completion of this alternative as proof: Always permit a correct password regardless of risk
- Test normal versus anomalous contexts and observe differentiated decisions
- Run this adjacent but different test as the sole proof: Attempt owner-driven label downgrades and verify rejection
Explanation
Correct Answer
C:Policy effectiveness requires context sensitivity.
Incorrect Answers
A:Test normal versus anomalous contexts and observe differentiated decisions. Policy effectiveness requires context sensitivity.
B:Credentials alone may be compromised. Test normal versus anomalous contexts and observe differentiated decisions.
D:Enforced labeling demonstrates MAC. It tests mac, while this case requires evidence about risk-based access.
Question 372
An incident review documented this policy decision/enforcement exposure: A zero-trust gateway has a correct access policy but an application endpoint bypasses the gateway. The response team proposed only “Update only the policy text without fixing bypass route” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Layer-three rules cannot implement the entire policy.
- Credentials alone may be compromised.
- Discretion does not imply unrestricted public access.
- Unmediated calls still succeed.
Explanation
Correct Answer
D:Unmediated calls still succeed. The relevant alternative is unmediated calls still succeed.
Incorrect Answers
A:Layer-three rules cannot implement the entire policy. The actual criticized measure is unmediated calls still succeed.
B:Credentials alone may be compromised. The actual criticized measure is unmediated calls still succeed.
C:Discretion does not imply unrestricted public access. The actual criticized measure is unmediated calls still succeed.
Question 373
A separate design-change proposal for rbac would rely principally on “Manage permissions through unrelated personal exceptions only” in the following situation: A hospital application gives every nurse database administrator privileges to view patient charts. Which technical or managerial assessment MOST directly challenges the proposal?
- Unmediated calls still succeed.
- Formal clearance and need to know are still required.
- Shared broad authority defeats separation.
- Individual exceptions become ungovernable.
Explanation
Correct Answer
D:Individual exceptions become ungovernable. The proposed control is Manage permissions through unrelated personal exceptions only, whereas the risk requires map job functions to narrowly scoped roles with permissions separated by task.
Incorrect Answers
A:This addresses a different alternative associated with policy decision/enforcement and does not identify the relevant mismatch.
B:This is an incorrect-design explanation for a different mac concern; it does not evaluate the quoted proposal.
C:This applies to Grant all medical staff one administrator role, not the specific proposed action that must be challenged here.
Question 374
An employee changes departments and retains former privileged access despite new job approval. Which response best addresses the central security requirement with a defensible, risk-based design?
- Automate entitlement updates triggered by authoritative employment lifecycle changes
- Add new rights without revoking old ones
- Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls
- Wait for annual audit to discover all leavers
Explanation
Correct Answer
A:Mover events must remove old access as well as grant new access.
Incorrect Answers
B:Privilege accumulation persists.
C:Service identities need stable ownership independent of employee turnover. Automate entitlement updates triggered by authoritative employment lifecycle changes.
D:Delays leave long access windows.
Question 375
A business application contains accounts owned by departed staff and reviewers blindly click approve all. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require accountable entitlement recertification with usage evidence and challenge of stale rights
- Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls
- Keep auto-approving every account
- Give the application admin sole approval of own access
Explanation
Correct Answer
A:Periodic reviews must validate continuing business need, not just produce signatures.
Incorrect Answers
B:Service identities need stable ownership independent of employee turnover. Require accountable entitlement recertification with usage evidence and challenge of stale rights.
C:Rubber-stamp reviews cannot detect privilege drift.
D:Self-review weakens independence.
Question 376
An unattended integration runs under a former employee's personal user account. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require accountable entitlement recertification with usage evidence and challenge of stale rights
- Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls
- Keep the personal account active forever
- Put the shared secret in a public repository
Explanation
Correct Answer
B:Service identities need stable ownership independent of employee turnover.
Incorrect Answers
A:Periodic reviews must validate continuing business need, not just produce signatures. Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls.
C:Orphaned personal credentials bypass offboarding.
D:Uncontrolled secret distribution creates exposure.
Question 377
A delegated engineer can edit the trust policy of a high-privilege role it cannot normally assume. Which response best addresses the central security requirement with a defensible, risk-based design?
- Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants
- Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls
- Depend solely on activity alerts for role changes
- Check only the engineer's current data access
Explanation
Correct Answer
A:Permission to change who may assume a role can yield indirect admin rights.
Incorrect Answers
B:Service identities need stable ownership independent of employee turnover. Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants.
C:Detection may occur after escalation.
D:Indirect trust edits can confer future privilege.
Question 378
A company has hundreds of near-identical roles with unnecessary permissions inherited from old projects. Which response best addresses the central security requirement with a defensible, risk-based design?
- Redesign roles by actual job functions and use bounded access packages and review
- Keep adding exceptions to old roles indefinitely
- Merge every role into superadministrator
- Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants
Explanation
Correct Answer
A:Role engineering reduces privilege sprawl while keeping manageable assignments.
Incorrect Answers
B:Accumulated exceptions increase drift.
C:Role consolidation without least privilege magnifies exposure.
D:Permission to change who may assume a role can yield indirect admin rights. Redesign roles by actual job functions and use bounded access packages and review.
Question 379
A sales manager transfers to accounting but retains broad sales export permissions after role change. Which response best addresses the central security requirement with a defensible, risk-based design?
- Remove obsolete entitlements at transfer and assign only approved new-role access
- Grant accounting roles without revisiting sales rights
- Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants
- Wait for the next annual audit to remove obsolete permissions
Explanation
Correct Answer
A:Mover events are not merely additive authorization.
Incorrect Answers
B:Accumulated access violates least privilege.
C:Permission to change who may assume a role can yield indirect admin rights. Remove obsolete entitlements at transfer and assign only approved new-role access.
D:Long retention creates avoidable exposure.
Question 380
A department owner approves hundreds of access attestations without seeing entitlement purpose or recent usage. Which response best addresses the central security requirement with a defensible, risk-based design?
- Let the system owner certify their own privileged role without independent review
- Provide resource context, privilege rationale and accountable recertification decisions
- Auto-approve all old permissions to save time
- Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants
Explanation
Correct Answer
B:Rubber-stamp attestations do not provide meaningful access governance.
Incorrect Answers
A:Self-review weakens assurance.
C:Age does not establish need.
D:Permission to change who may assume a role can yield indirect admin rights. Provide resource context, privilege rationale and accountable recertification decisions.
Certified Information Systems Security Professional (CISSP) Practice Tests