Question 480
A production Kubernetes cluster has progressively gained broad administrative bindings not present in its approved manifests. Which response best addresses the central security requirement with a defensible, risk-based design?
- Detect and reconcile actual roles against a version-controlled approved configuration
- Delete every workload whenever drift appears without investigating cause
- Allow manual bindings to override Git indefinitely
- Maintain a versioned, owner-approved secure configuration baseline for each device class
Explanation
Correct Answer
A:Drift can increase privilege even without a planned change.
Incorrect Answers
B:Disruption may be excessive and hide root cause.
C:Untracked permissions remain effective.
D:Baselines provide the reference for controlled change and compliance. Detect and reconcile actual roles against a version-controlled approved configuration.
Question 481
An incident team cannot find owners for retired virtual machines still reachable on the internal network. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume devices with old hostnames have been removed
- Integrate discovery with asset inventory, accountable owners and decommissioning status
- Use controlled configuration-as-code with approvals, idempotent deployment and rollback
- Use procurement invoices as the only live asset inventory
Explanation
Correct Answer
B:Unknown assets evade patching and incident response.
Incorrect Answers
A:Naming does not prove absence.
C:Automation reduces inconsistent application while retaining traceability. Integrate discovery with asset inventory, accountable owners and decommissioning status.
D:Purchased and running assets differ.
Question 482
After a prior baseline finding, a payment-services company reports that the approved safeguard is implemented: “Maintain a versioned, owner-approved secure configuration baseline for each device class.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Maintain a versioned, owner-approved secure configuration baseline for each device class
- Use the completion of this alternative as proof: Use the last administrator's memory as the approved baseline
- Compare sampled live configurations with the approved version and investigate differences
- Run this adjacent but different test as the sole proof: Deploy a representative sample, compare desired and actual settings, and confirm rollback works
Explanation
Correct Answer
C:Evidence-based comparison detects baseline deviation.
Incorrect Answers
A:Compare sampled live configurations with the approved version and investigate differences. Evidence-based comparison detects baseline deviation.
B:Informal recollection is unverifiable. Compare sampled live configurations with the approved version and investigate differences.
D:Staged validation tests automation safety and completeness. It tests automation, while this case requires evidence about baseline.
Question 483
The overnight operations shift uses a generic administrator account for backup monitoring. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assign a dedicated scoped monitoring identity and just-in-time privileged escalation only where needed
- Give operators permanent directory-wide administration
- Share one privileged password among rotating staff
- Measure compliance per the agreed severity and service-level terms including missed response windows
Explanation
Correct Answer
A:Operations roles should be proportional and attributable.
Incorrect Answers
B:Broad standing access enlarges harm.
C:Shared credentials destroy individual attribution.
D:Averages can obscure repeated breaches of high-priority response commitments. Assign a dedicated scoped monitoring identity and just-in-time privileged escalation only where needed.
Question 484
One engineer can deploy a database schema and approve its own sensitive-data migration. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assign a dedicated scoped monitoring identity and just-in-time privileged escalation only where needed
- Require the same engineer to sign twice
- Log self-approval but never challenge the transaction
- Separate deployment and approval roles or establish reviewed compensating controls
Explanation
Correct Answer
D:Separation of duties reduces error and fraud from unilateral changes.
Incorrect Answers
A:Operations roles should be proportional and attributable. Separate deployment and approval roles or establish reviewed compensating controls.
B:Two signatures do not create independent review.
C:Logging does not enforce independence.
Question 485
A maintenance vendor needs production administrator rights only during scheduled repair windows. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assign a dedicated scoped monitoring identity and just-in-time privileged escalation only where needed
- Grant time-limited, monitored privileged access with explicit approval and automatic expiry
- Leave vendor administrator keys active indefinitely
- Grant unrestricted access without recording who used it
Explanation
Correct Answer
B:Temporary entitlement limits standing privileges and establishes accountability.
Incorrect Answers
A:Operations roles should be proportional and attributable. Grant time-limited, monitored privileged access with explicit approval and automatic expiry.
C:Persistent external privileges survive the repair.
D:Unattributable changes impede investigation.
Question 486
A finance security administrator has exclusive knowledge of critical signing-key procedures and has never taken leave. Which response best addresses the central security requirement with a defensible, risk-based design?
- Concentrate all duties permanently in the same person
- Implement documented cross-training, controlled job rotation and mandatory leave where appropriate
- Grant time-limited, monitored privileged access with explicit approval and automatic expiry
- Publish the signing keys in a general operations wiki
Explanation
Correct Answer
B:Rotation reveals hidden dependencies and potential concealment while supporting continuity.
Incorrect Answers
A:Single-person dependence worsens outages and concealment.
C:Temporary entitlement limits standing privileges and establishes accountability. Implement documented cross-training, controlled job rotation and mandatory leave where appropriate.
D:Broad secret sharing is not continuity engineering.
Question 487
A security provider promised priority incident triage within 20 minutes but reports only monthly average response. Which response best addresses the central security requirement with a defensible, risk-based design?
- Exclude incidents that violated the window from reporting
- Implement documented cross-training, controlled job rotation and mandatory leave where appropriate
- Measure compliance per the agreed severity and service-level terms including missed response windows
- Use annual uptime instead of incident response
Explanation
Correct Answer
C:Averages can obscure repeated breaches of high-priority response commitments.
Incorrect Answers
A:Removing failures biases the metric.
B:Rotation reveals hidden dependencies and potential concealment while supporting continuity. Measure compliance per the agreed severity and service-level terms including missed response windows.
D:Availability is a different service measure.
Question 488
Unencrypted backup cartridges are transported by a courier with no inventory of serial numbers. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely on a plain shipping label as access control
- Encrypt the media, register chain of custody and approve secure shipment procedures
- Restrict removable media with endpoint controls and approved encrypted exception workflows
- Send cartridges without confirming receipt
Explanation
Correct Answer
B:Physical transport can expose durable sensitive copies.
Incorrect Answers
A:Labels do not protect data confidentiality.
C:Uncontrolled portable copies evade custody and revocation. Encrypt the media, register chain of custody and approve secure shipment procedures.
D:Missing accountability weakens custody.
Question 489
A partner exports regulated records over a leased line and assumes the circuit itself encrypts traffic. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only a file checksum as encryption
- Allow cleartext because the carrier is under contract
- Enable strong full-disk encryption with protected keys and enforced recovery handling
- Apply approved end-to-end transport encryption and authenticate the partner endpoint
Explanation
Correct Answer
D:Dedicated physical transport is not equivalent to cryptographic confidentiality.
Incorrect Answers
A:Checksums detect change but do not hide data.
B:Contracts cannot prevent interception on a compromised link.
C:Network encryption does not defend data stored on a stolen drive. Apply approved end-to-end transport encryption and authenticate the partner endpoint.
Question 490
A laptop fleet has secure VPN but stolen disks can still be mounted on another system. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only screen lock and rely on device casing
- Apply approved end-to-end transport encryption and authenticate the partner endpoint
- Enable strong full-disk encryption with protected keys and enforced recovery handling
- Keep all recovery keys in a plaintext shared folder
Explanation
Correct Answer
C:Network encryption does not defend data stored on a stolen drive.
Incorrect Answers
A:Offline disk access can bypass the login screen.
B:Dedicated physical transport is not equivalent to cryptographic confidentiality. Enable strong full-disk encryption with protected keys and enforced recovery handling.
D:Poor key custody undermines encryption.
Certified Information Systems Security Professional (CISSP) Practice Tests