Question 380
A department owner approves hundreds of access attestations without seeing entitlement purpose or recent usage. Which response best addresses the central security requirement with a defensible, risk-based design?
- Let the system owner certify their own privileged role without independent review
- Provide resource context, privilege rationale and accountable recertification decisions
- Auto-approve all old permissions to save time
- Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants
Explanation
Correct Answer
B:Rubber-stamp attestations do not provide meaningful access governance.
Incorrect Answers
A:Self-review weakens assurance.
C:Age does not establish need.
D:Permission to change who may assume a role can yield indirect admin rights. Provide resource context, privilege rationale and accountable recertification decisions.
Question 381
After a prior service accounts finding, a university consortium reports that the approved safeguard is implemented: “Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Attempt a controlled trust-policy modification and verify denial
- Use the completion of this alternative as proof: Keep the personal account active forever
- Accept a signed change ticket saying: Provision a separately owned workload identity with narrowly scoped credentials and lifecycle controls
- Rotate/disable service credentials without affecting personal employee accounts
Explanation
Correct Answer
D:Independent revocation proves ownership separation.
Incorrect Answers
A:Escalation tests include permissions to change permissions. It tests privilege escalation, while this case requires evidence about service accounts.
B:Orphaned personal credentials bypass offboarding. Rotate/disable service credentials without affecting personal employee accounts.
C:Rotate/disable service credentials without affecting personal employee accounts. Independent revocation proves ownership separation.
Question 382
After a prior privilege escalation finding, a cloud service provider reports that the approved safeguard is implemented: “Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Rotate/disable service credentials without affecting personal employee accounts
- Accept a signed change ticket saying: Restrict control-plane role mutation and validate privilege-escalation paths, not just current action grants
- Attempt a controlled trust-policy modification and verify denial
- Use the completion of this alternative as proof: Check only the engineer's current data access
Explanation
Correct Answer
C:Escalation tests include permissions to change permissions.
Incorrect Answers
A:Independent revocation proves ownership separation. It tests service accounts, while this case requires evidence about privilege escalation.
B:Attempt a controlled trust-policy modification and verify denial. Escalation tests include permissions to change permissions.
D:Indirect trust edits can confer future privilege. Attempt a controlled trust-policy modification and verify denial.
Question 383
After a prior role redesign finding, a regulated financial institution reports that the approved safeguard is implemented: “Redesign roles by actual job functions and use bounded access packages and review.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Merge every role into superadministrator
- Run this adjacent but different test as the sole proof: Attempt a controlled trust-policy modification and verify denial
- Accept a signed change ticket saying: Redesign roles by actual job functions and use bounded access packages and review
- Compare approved roles to observed business duties and unnecessary rights
Explanation
Correct Answer
D:Role quality is measured by fit and reduced privilege.
Incorrect Answers
A:Role consolidation without least privilege magnifies exposure. Compare approved roles to observed business duties and unnecessary rights.
B:Escalation tests include permissions to change permissions. It tests privilege escalation, while this case requires evidence about role redesign.
C:Compare approved roles to observed business duties and unnecessary rights. Role quality is measured by fit and reduced privilege.
Question 384
After a prior joiner-mover-leaver finding, a global logistics firm reports that the approved safeguard is implemented: “Automate entitlement updates triggered by authoritative employment lifecycle changes.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Perform a simulated transfer and inspect before/after effective grants
- Run this adjacent but different test as the sole proof: Compare approved roles to observed business duties and unnecessary rights
- Accept a signed change ticket saying: Automate entitlement updates triggered by authoritative employment lifecycle changes
- Use the completion of this alternative as proof: Add new rights without revoking old ones
Explanation
Correct Answer
A:Lifecycle tests show least privilege over time.
Incorrect Answers
B:Role quality is measured by fit and reduced privilege. It tests role redesign, while this case requires evidence about joiner-mover-leaver.
C:Perform a simulated transfer and inspect before/after effective grants. Lifecycle tests show least privilege over time.
D:Privilege accumulation persists. Perform a simulated transfer and inspect before/after effective grants.
Question 385
After a prior access recertification finding, a regional hospital network reports that the approved safeguard is implemented: “Require accountable entitlement recertification with usage evidence and challenge of stale rights.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Keep auto-approving every account
- Accept a signed change ticket saying: Require accountable entitlement recertification with usage evidence and challenge of stale rights
- Sample reviewer decisions against user employment and access activity
- Run this adjacent but different test as the sole proof: Attempt a controlled trust-policy modification and verify denial
Explanation
Correct Answer
C:Evidence-based review catches orphaned access.
Incorrect Answers
A:Rubber-stamp reviews cannot detect privilege drift. Sample reviewer decisions against user employment and access activity.
B:Sample reviewer decisions against user employment and access activity. Evidence-based review catches orphaned access.
D:Escalation tests include permissions to change permissions. It tests privilege escalation, while this case requires evidence about access recertification.
Question 386
An incident review documented this service accounts exposure: An unattended integration runs under a former employee's personal user account. The response team proposed only “Keep the personal account active forever” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Delays leave long access windows.
- Orphaned personal credentials bypass offboarding.
- Indirect trust edits can confer future privilege.
- Uncontrolled secret distribution creates exposure.
Explanation
Correct Answer
B:Orphaned personal credentials bypass offboarding. The relevant alternative is orphaned personal credentials bypass offboarding.
Incorrect Answers
A:Delays leave long access windows. The actual criticized measure is orphaned personal credentials bypass offboarding.
C:Indirect trust edits can confer future privilege. That does not establish orphaned personal credentials bypass offboarding.
D:Uncontrolled secret distribution creates exposure. The actual criticized measure is orphaned personal credentials bypass offboarding.
Question 387
A wireless network requires centralized authentication and policy enforcement through its access points. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use appropriate RADIUS-based AAA between network devices and an identity service
- Use a shared access point admin password for every client
- Use ordinary DNS as user authentication
- Validate client certificate chain, identity mapping, key usage and revocation
Explanation
Correct Answer
A:RADIUS commonly serves network access authentication and accounting.
Incorrect Answers
B:Device management secret is not user AAA.
C:DNS resolution does not authorize clients.
D:Possessing an arbitrary certificate is not proof of approved identity. Use appropriate RADIUS-based AAA between network devices and an identity service.
Question 388
A network operations team needs command-by-command authorization for privileged router administrators. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use RADIUS accounting alone to decide every router command
- Use TACACS+ where supported for fine-grained network device administration controls
- Validate client certificate chain, identity mapping, key usage and revocation
- Share local root accounts on switches
Explanation
Correct Answer
B:TACACS+ separates administrative AAA functions and can authorize commands.
Incorrect Answers
A:General network access accounting is not equivalent to command policy.
C:Possessing an arbitrary certificate is not proof of approved identity. Use TACACS+ where supported for fine-grained network device administration controls.
D:Shared accounts prevent individual command attribution.
Question 389
A domain user obtains one ticket but a server wrongly accepts a forged service ticket. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trust only the displayed username inside a ticket
- Validate Kerberos ticket signatures, SPNs, time and trusted KDC relationships
- Disable clock synchronization across the realm
- Use appropriate RADIUS-based AAA between network devices and an identity service
Explanation
Correct Answer
B:Kerberos uses a ticket-granting process with time-bound shared-key authentication.
Incorrect Answers
A:Unverified ticket content is not authentication.
C:Excessive skew can break ticket validation.
D:RADIUS commonly serves network access authentication and accounting. Validate Kerberos ticket signatures, SPNs, time and trusted KDC relationships.
Question 390
A privileged remote-access gateway trusts any client certificate including one issued by an unknown CA. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate client certificate chain, identity mapping, key usage and revocation
- Ignore revocation after a laptop is stolen
- Use appropriate RADIUS-based AAA between network devices and an identity service
- Accept self-signed certificates without trust enrollment
Explanation
Correct Answer
A:Possessing an arbitrary certificate is not proof of approved identity.
Incorrect Answers
B:Compromised certificates can stay usable.
C:RADIUS commonly serves network access authentication and accounting. Validate client certificate chain, identity mapping, key usage and revocation.
D:Untrusted issuers can claim arbitrary identities.
Certified Information Systems Security Professional (CISSP) Practice Tests