AP Networking Secure Access, Authentication, and Authorization Practice Test

1. Permission for every resource
2. The maximum interface rate
3. A route to every subnet
4. Evidence for a claimed identity

Correct answer: D. Evidence for a claimed identity

Identity checking is distinct from authorization. A recognized user can still lack permission for a particular operation.

1. Only the device's link speed
2. Whether the identified subject may perform the requested action on a resource
3. Only the subject's IP mask
4. Whether every packet is encrypted

Correct answer: B. Whether the identified subject may perform the requested action on a resource

Authorization applies policy to access. It should be evaluated for the actual resource and action rather than inferred from successful login.

1. Grant everyone administrator rights temporarily
2. Grant only the access needed for the approved task
3. Use one shared password for all roles
4. Block every required service

Correct answer: B. Grant only the access needed for the approved task

Least privilege ties permissions to requirements. It supports necessary work while reducing unrelated access.

1. A password and a PIN only
2. A password and a possession-based security key
3. Two knowledge questions
4. Two different passwords

Correct answer: B. A password and a possession-based security key

Different factor categories provide different kinds of evidence. Two secrets from the knowledge category do not by themselves become multifactor authentication.

1. Every endpoint from malware
2. Every user from excessive permissions
3. All application correctness
4. Confidentiality of protected data moving between appropriate endpoints

Correct answer: D. Confidentiality of protected data moving between appropriate endpoints

Encryption protects the covered exchange, not all endpoint behavior or authorization. Identity validation and endpoint security remain separate dependencies.

1. No; identity, device state, and access policy still matter
2. Yes; every local endpoint is authorized
3. Only if the cable is blue
4. Yes; a private IP authenticates the user

Correct answer: A. No; identity, device state, and access policy still matter

Network location is context, not sufficient identity or permission evidence. Evaluate the approved subject, device, resource, and action.

1. To remove every DNS query
2. To enforce a defined access boundary between different needs
3. To make every guest a network administrator
4. To guarantee that no guest can be compromised

Correct answer: B. To enforce a defined access boundary between different needs

Segmentation reduces unintended reach when policy enforces the boundary. Separate VLAN labels alone do not prove all cross-segment access is controlled.

1. No access to any approved remediation service
2. Automatic administrator privileges
3. Unrestricted access to every protected server
4. The approved remediation needs while restricting unrelated resources

Correct answer: D. The approved remediation needs while restricting unrelated resources

Quarantine is a controlled state with an explicit purpose. Provide only the resources needed to remediate and re-evaluate eligibility.

1. Calculating cable length only
2. Assigning every client a public IP
3. Recording relevant access and activity events
4. Replacing authentication

Correct answer: C. Recording relevant access and activity events

Accounting supports review and attribution. It does not replace identity verification or permission enforcement.

1. Only a lifetime byte counter
2. Only a signal-strength icon
3. Only a DNS suffix
4. A time-matched identity/resource/action result from the enforcing system

Correct answer: D. A time-matched identity/resource/action result from the enforcing system

Tie the decision to the actual subject, resource, and policy at the relevant time. A connectivity indicator does not describe authorization.

1. All name resolution
2. All routing
3. The requested administrative authorization
4. All authentication necessarily

Correct answer: C. The requested administrative authorization

A valid identity can be denied an unapproved action. Distinguish expected policy behavior from a connectivity fault.

1. To eliminate all logs
2. To double the link bandwidth
3. To limit routine activity's privileges and clarify administrative use
4. To guarantee accounts cannot be stolen

Correct answer: C. To limit routine activity's privileges and clarify administrative use

Role separation reduces unnecessary exposure and aids attribution. It still requires appropriate account protections and use policies.

1. That the remote server has no vulnerabilities
2. That all routes are shortest
3. That every application action is authorized
4. That the presented identity meets the client's trust and hostname checks

Correct answer: D. That the presented identity meets the client's trust and hostname checks

Validating identity is one security stage. It does not prove application permissions, endpoint health, or service correctness.

1. They weaken control and accountability for privileged access
2. They always improve user attribution
3. They are required for every VLAN
4. They prevent all remote attacks

Correct answer: A. They weaken control and accountability for privileged access

Use approved unique or managed privileged access. Shared defaults make it harder to control entry and attribute actions.

1. Only the number of switch ports
2. Only a user's favorite website
3. Specified device conditions relevant to access policy
4. Only the public DNS record

Correct answer: C. Specified device conditions relevant to access policy

Posture may include managed-state or required safeguards. The exact conditions are policy choices and should be stated rather than assumed.

1. Addresses can never be reassigned
2. Every IP is a cryptographic user credential
3. All users have one permanent public address
4. The address is not by itself proof of a particular user's identity

Correct answer: D. The address is not by itself proof of a particular user's identity

Address-based controls can be useful but have attribution limits. Reassignment, sharing, proxies, and spoofing context can weaken identity assumptions.

1. It states which subjects need which resources and actions
2. It automatically installs every route
3. It replaces all verification
4. It assigns link-layer addresses

Correct answer: A. It states which subjects need which resources and actions

A matrix makes required and prohibited cases concrete. Translate those requirements into the actual enforcement design and test both outcomes.

1. Publish its password for reuse
2. Retain every permission indefinitely
3. Remove or revoke access under the approved lifecycle process
4. Assign it to another person without review

Correct answer: C. Remove or revoke access under the approved lifecycle process

Access should track current responsibilities. Lifecycle control reduces unused privileges and improves accountability.

1. That only approved sources and identities can use the service
2. That the segment number is large
3. That the VLAN name contains management
4. That the switch has many ports

Correct answer: A. That only approved sources and identities can use the service

Segmentation must have effective policy and authorized paths. Naming a VLAN does not create a complete administrative access boundary.

1. Disable all controls to see what happens
2. Check that an explicitly prohibited source/action remains denied under authorized testing
3. Attempt unlimited production attacks without scope
4. Use another person's stolen credentials

Correct answer: B. Check that an explicitly prohibited source/action remains denied under authorized testing

Negative verification confirms boundaries as part of an approved test plan. Scope and test identities should be explicit.

1. Whether all packets need a larger MTU
2. The requested hostname, presented certificate identity, trust, and intended endpoint
3. Whether validation can be disabled globally
4. Whether the user should gain administrator rights

Correct answer: B. The requested hostname, presented certificate identity, trust, and intended endpoint

Determine why identity validation fails. Bypassing the check can hide misrouting or impersonation rather than repair the service.

1. It guarantees recovery never fails
2. It removes the need for audit records
3. It restores legitimate access without creating uncontrolled permanent exceptions
4. It requires all passwords to be public

Correct answer: C. It restores legitimate access without creating uncontrolled permanent exceptions

Recovery needs defined ownership, verification, limited scope, and review. An improvised broad exception can outlast the incident and weaken the intended boundary.

1. Their confidentiality, integrity, availability, and appropriate retention
2. Only their font size
3. Only their alphabetical order
4. Only their file extension

Correct answer: A. Their confidentiality, integrity, availability, and appropriate retention

Logs can contain sensitive identity and activity information. Protect them so investigations can rely on authorized, intact records.

1. The portal stage passed, not universal internal authorization
2. Every service is encrypted
3. All VLAN rules have disappeared
4. The user now owns every internal resource

Correct answer: A. The portal stage passed, not universal internal authorization

Portal authorization is one stage with a defined scope. Verify intended Internet access and continued internal restrictions separately.

1. Roles alter only the cable speed
2. A privileged test account may bypass the failing or prohibited condition
3. A successful admin login proves all student access
4. Every identity receives identical policy

Correct answer: B. A privileged test account may bypass the failing or prohibited condition

The actual subject context can change decisions. Representative approved identities make verification match the requirement.

1. Only the DHCP lease length
2. The required role assignment and requested resource/action
3. Only the gateway MAC address
4. Only interface errors

Correct answer: B. The required role assignment and requested resource/action

Identity success narrows the failure to later permission or application logic. Check the intended role rather than reset the whole network path.

1. Proof that IPv4 rules control IPv6 automatically
2. Equivalent intended enforcement across the enabled IPv6 path
3. A larger IPv4 subnet
4. A second DNS A record

Correct answer: B. Equivalent intended enforcement across the enabled IPv6 path

An alternate address family can bypass incomplete policy. Verify each enabled path under the same access requirements.

1. Whether MAC addresses contain patch status
2. How and when eligibility is re-evaluated for existing access
3. Whether DNS TTL revokes every session
4. Whether one admission result proves permanent compliance

Correct answer: B. How and when eligibility is re-evaluated for existing access

Admission is a time-specific result. Re-evaluation and session response depend on the implementation and stated policy.

1. Any device that claims a printer-like hostname
2. A shared administrator password in DHCP
3. Explicit identity/attachment criteria and the minimum needed destinations/services
4. Unrestricted access to all servers

Correct answer: C. Explicit identity/attachment criteria and the minimum needed destinations/services

An exception should match a justified need and be verifiable. Device labels or self-reported names alone are weak admission evidence.

1. Only the signal-strength history
2. Only the switch's chassis model
3. Effective group membership, policy evaluation, and the requested operation
4. Only the number of hops

Correct answer: C. Effective group membership, policy evaluation, and the requested operation

The changed role context is a direct lead. Inspect the decision actually enforced rather than infer all permissions from group names.

1. A valid DNS certificate always covers every IP
2. The certificate may not cover the requested IP identity
3. The IP address changes the TLS version by definition
4. TLS works only over Wi-Fi

Correct answer: B. The certificate may not cover the requested IP identity

Validation checks the identity requested by the client. Use the approved name/path or an appropriately configured identity; do not disable validation to hide the mismatch.

1. The DNS server must be responsible
2. Every authentication attempt still succeeded
3. The fail-open behavior grants access during a control-plane failure
4. Fail-open is always equivalent to normal policy

Correct answer: C. The fail-open behavior grants access during a control-plane failure

Fallback behavior is a design choice with availability and security consequences. State the allowed degraded access and verify the actual failure mode.

1. Only the edge's link rate
2. Session/token lifetime, revocation, and application re-evaluation behavior
3. Only the client's subnet mask
4. Only the DNS record's hostname

Correct answer: B. Session/token lifetime, revocation, and application re-evaluation behavior

Changing directory membership may not instantly invalidate issued sessions. Check the system's documented enforcement lifecycle and the required revocation goal.

1. Permit every internal service for convenience
2. Deny all remediation traffic indefinitely
3. Permit those approved dependencies and deny unrelated resources
4. Grant local administrator rights to all endpoints

Correct answer: C. Permit those approved dependencies and deny unrelated resources

Remediation needs a usable narrow path. Validate actual destination/service dependencies and retain isolation from protected systems.

1. Every user must have a public IPv4 address
2. NAT makes every role identical in the directory
3. The address encrypts role membership
4. It does not distinguish the individual subjects

Correct answer: D. It does not distinguish the individual subjects

Shared network identity and application identity are different. Use approved subject-level authentication and authorization for role decisions.

1. It replaces all policy tests
2. It guarantees least privilege
3. It may not explain a user-reported rejection or attempted prohibited path
4. It proves no denial occurred

Correct answer: C. It may not explain a user-reported rejection or attempted prohibited path

Denial evidence can be important for diagnosis and verification. Choose logging scope and retention under operational and privacy requirements.

1. Only widening the network permit
2. Only replacing the switch
3. Only changing every client's gateway
4. The application role and operation after permitted network delivery

Correct answer: D. The application role and operation after permitted network delivery

A network policy match is not application authorization. The server response identifies a later decision stage to inspect.

1. Whether disabling one user always removes every device credential
2. Whether the subnet mask is too long
3. Whether certificates are the same as DNS records
4. Separate user and device credential revocation and resulting resource permissions

Correct answer: D. Separate user and device credential revocation and resulting resource permissions

Credential types can have separate ownership and expiry. Review both subjects and the effective resource boundary rather than assume one action revokes everything.

1. Time synchronization and certificate validity-period evaluation
2. Only NAT allocation capacity
3. Only DHCP's maximum host count
4. Only the switch trunk list

Correct answer: A. Time synchronization and certificate validity-period evaluation

Certificate validity uses time bounds. Confirm clock behavior and trust configuration before replacing an otherwise correct service identity.

1. Only the resolver's cache size
2. The enforced segment assignment and downstream policy, not only the admission result
3. Only the Wi-Fi signal bars
4. Only the user password

Correct answer: B. The enforced segment assignment and downstream policy, not only the admission result

A control decision must be applied correctly. Check switch/AP assignment, propagation, address configuration, and actual access tests.

1. Only successful login
2. Approved reads succeed and prohibited write/admin actions are denied
3. Only granting full control then checking reads
4. Only repository ping

Correct answer: B. Approved reads succeed and prohibited write/admin actions are denied

Action-level scope matters. A successful read alone does not show that excessive privileges are absent.

1. Only the phrase until fixed
2. Only a new VLAN name
3. Owner, justification, exact scope, expiry/review, and removal verification
4. Only a broad permit for every user

Correct answer: C. Owner, justification, exact scope, expiry/review, and removal verification

Temporary exceptions need lifecycle controls. Explicit expiry and ownership reduce the chance that emergency access becomes an unreviewed permanent rule.

1. It can never change
2. A MAC value can be copied or spoofed and is not strong user authentication
3. It is a public certificate
4. It cryptographically proves device ownership

Correct answer: B. A MAC value can be copied or spoofed and is not strong user authentication

MAC-based exceptions may serve constrained operational needs but provide weak identity assurance. Apply compensating scope and verification under the design.

1. Only the successful DNS response
2. Only the portal's logo
3. Only the device's hostname
4. Whether all direct paths enforce the required resource authorization

Correct answer: D. Whether all direct paths enforce the required resource authorization

A front-door decision is ineffective if another path bypasses it. Map direct addresses, alternate ports, proxies, and families against the same requirement.

1. Disabling status collection
2. More shared admin accounts
3. An approved read-only role limited to necessary resources
4. Publishing all credentials in logs

Correct answer: C. An approved read-only role limited to necessary resources

The task's requirement is observation rather than configuration. Reduce privilege while preserving needed visibility and verify that write operations remain denied.

1. Only if the connection is wired
2. Yes; device state cannot affect policy
3. Yes; every valid password must permit access
4. No; identity may pass while the separate device condition fails

Correct answer: D. No; identity may pass while the separate device condition fails

Policy can combine user and device conditions. Explain the failed condition and approved remediation rather than treating every rejection as an identity error.

1. An effective path or control gap that must be traced
2. That VLAN names alone enforce authorization
3. That every guest has passed staff authentication
4. That encryption removes the concern

Correct answer: A. An effective path or control gap that must be traced

Trace actual routing, addresses, services, and identity controls. Segmentation labels do not prove the intended administrative boundary.

1. Whether any HTTPS icon proves the right organization
2. The intended endpoint and identity before entering credentials
3. Whether the subnet is large enough
4. Whether a familiar logo is sufficient proof

Correct answer: B. The intended endpoint and identity before entering credentials

A valid encrypted connection to the wrong domain can still be inappropriate. Match the actual hostname and trusted service path, then investigate unexpected redirection.

1. Only the user's group name
2. Device-state and credential requirements under the effective policy
3. Only the public DNS TTL
4. Only the password length

Correct answer: B. Device-state and credential requirements under the effective policy

The controlled identity comparison points toward device context or credential presentation. It does not prove that the personal device should be admitted.

1. A complete success because one user works
2. A reason to stop logging
3. Proof that least privilege is impossible
4. The repair has not met the complete access requirement

Correct answer: D. The repair has not met the complete access requirement

Both required and forbidden cases are part of the intended behavior. Narrow or correct the rule and repeat representative positive and negative tests.

1. Resource/action authorization after authentication
2. Reset the network gateway because all privilege errors are path failures
3. Treat successful MFA as permission for every action exposed by the application
4. Assume authentication failure solely from the unauthorized action outcome

Correct answer: A. Resource/action authorization after authentication

Strong identity proof does not grant every permission. Inspect role, action checks, and effective application enforcement for the administrative request.

1. Keep broad fallback permanently without verifying guest management denial
2. Define and verify a constrained degraded-access policy plus recovery review
3. Declare success solely because classes regained connectivity
4. Treat every endpoint as staff whenever the identity system is unavailable

Correct answer: B. Define and verify a constrained degraded-access policy plus recovery review

Availability and security requirements must both be explicit. A narrowly designed fallback can preserve approved tasks without converting every endpoint into a trusted administrator.

1. Change only the user's password and omit resource token acceptance tests
2. Token validation, expiry/revocation, and resource-side enforcement
3. Assume directory login rejection instantly invalidates every existing bearer token
4. Use DHCP lease expiry as the sole revocation mechanism for the application

Correct answer: B. Token validation, expiry/revocation, and resource-side enforcement

The existing token follows a separate lifecycle from new login. Verify how the resource stops accepting issued credentials within the required revocation period.

1. Effective forwarding attachment and required/prohibited resource tests at the client
2. Accept the controller's restricted label as proof of actual staff-resource denial
3. Reset the student's credentials without checking enforced attachment
4. Assume an SSID name determines downstream VLAN placement

Correct answer: A. Effective forwarding attachment and required/prohibited resource tests at the client

The control-plane intention has not been applied correctly. Trace the mapping and prove the actual access boundary rather than accept the controller's record as end-to-end enforcement.

1. Name-based restriction, reachable administrative path, and weak privileged credentials all need attention
2. Assume private IP reachability makes privileged shared defaults acceptable
3. Treat hostname blocking as complete service enforcement despite direct access
4. Fix only the hostname resolution and retain reachable default-credential management

Correct answer: A. Name-based restriction, reachable administrative path, and weak privileged credentials all need attention

Several controls failed to enforce the requirement. Restrict the actual management service path and replace/default-manage credentials under the approved access design.

1. Connectivity improved while the required identity assurance remains unmet
2. Retain the global validation bypass as the only long-term repair
3. Treat successful encryption as proof of the intended host when checks were disabled
4. Call the change fully secure because the warning disappeared

Correct answer: A. Connectivity improved while the required identity assurance remains unmet

An exception that removes the failing check can conceal the problem. Restore correct hostname, endpoint, certificate, and trust behavior with appropriate verification.

1. Grant permanent staff-network access because the API is internal
2. Use a shared staff administrator account to avoid separate revocation
3. Time-limited identity/device/resource/action scope with audit and revocation tests
4. Authorize any device at the supplier's shared public address without action limits

Correct answer: C. Time-limited identity/device/resource/action scope with audit and revocation tests

Translate the stated need into a bounded policy and lifecycle. Verify necessary API actions, prohibited resources, and removal after the approved interval.

1. Grant the sensitive role solely from device certificate success
2. Treat the user's valid login as proof that every device condition also passed
3. The sensitive operation remains denied unless the human authorization also passes
4. Ignore human permissions because the device is on the managed LAN

Correct answer: C. The sensitive operation remains denied unless the human authorization also passes

User and device identities answer different questions. The sensitive resource requires the stated combination, not one substituted for the other.

1. Enumerate intended service paths and test the required boundary across both families and entry points
2. Verify only the IPv4 hostname path and assume the alternate listener is covered
3. Block one DNS answer while leaving direct protected-service paths open
4. Assume a guest VLAN label enforces identical policy on every enabled family

Correct answer: A. Enumerate intended service paths and test the required boundary across both families and entry points

Alternate paths can undermine a resource boundary. Verify the actual enabled addresses, listeners, routing, and authorization under the same access matrix.

1. Use any nearby deny event as proof of the tested operation's failed role
2. Widen the user's permissions before matching log time and resource
3. Time/resource/action correlation before using the log as the diagnosis
4. Ignore timezone interpretation because the account name appears in the event

Correct answer: C. Time/resource/action correlation before using the log as the diagnosis

A plausible deny record is not decisive unless it matches the tested operation and time. Align clocks and contexts before modifying permissions.

1. Assume encryption elsewhere compensates for every excessive printer permission
2. Retain whole-staff access because the exception has a printer label
3. Weak admission identity combined with excessive resource scope
4. Treat the copied MAC value as strong proof of printer identity

Correct answer: C. Weak admission identity combined with excessive resource scope

The exception relies on spoofable identification and grants more than the printer task needs. Narrow scope and use suitable approved identity/attachment controls.

1. Grant all students ownership before identifying the missing read decision
2. Infer ordinary student permission from the owner's broader role
3. Repeat only the application owner's successful login
4. Effective student-role decisions and the exact read resource/action under that role

Correct answer: D. Effective student-role decisions and the exact read resource/action under that role

Owner privileges can bypass ordinary policy. Representative role testing reveals missing grants or application behavior without weakening the whole system.

1. Use the directory account name as evidence that posture updates propagated
2. Verify only that the quarantine segment exists, omitting session access behavior
3. Accept the initial compliant result as proof of ten-minute enforcement
4. Reassessment timing, signal reliability, enforcement propagation, and session handling

Correct answer: D. Reassessment timing, signal reliability, enforcement propagation, and session handling

The policy is a time-bound lifecycle requirement. Measure detection-to-enforcement behavior and verify that remediation remains possible under the restricted state.

1. Restrict direct backend reach and enforce the intended identity/action boundary on every accepted path
2. Assume encrypted frontend transport enforces backend user permissions
3. Rely on proxy login denial even when direct backend access bypasses it
4. Add another portal check without constraining the direct accepted path

Correct answer: A. Restrict direct backend reach and enforce the intended identity/action boundary on every accepted path

An authorized front end is insufficient when a bypass remains. Match backend exposure and application enforcement to the architecture and test direct prohibited access.

1. Blame failed authentication even though the read-only subject can issue a write
2. Treat hiding the main edit button as sufficient write enforcement
3. Permit the second API because its URL differs from the main interface
4. Server-side action authorization on the alternate endpoint

Correct answer: D. Server-side action authorization on the alternate endpoint

Hiding a control is not enforcement. Each accepted action path must check the required permission rather than rely on a user-facing page.

1. Assume the VPN group and local gateway account are one identity because names match
2. Remove only the VPN group and omit independent entry-path tests
3. Inventory and revoke the supplier's distinct credentials and paths
4. Change the contractor's DNS name instead of revoking the local credential

Correct answer: C. Inventory and revoke the supplier's distinct credentials and paths

Names can match across independent stores without shared lifecycle. Review every authorized entry path and verify actual revocation.

1. Disable all monitoring without investigating a supported limited role
2. Assume status reading always requires configuration-write privileges
3. Grant unrestricted administrator scope because the requester is a vendor
4. The exact required operations and supported minimum privilege model

Correct answer: D. The exact required operations and supported minimum privilege model

Determine concrete resource/action needs before granting scope. Choose a supported role that satisfies collection while limiting configuration and sensitive operations.

1. Conclude every factor was cryptographically broken from the account-use outcome
2. Assume a valid session can only be obtained by repeating the original factors
3. No; examine session theft, recovery paths, enrollment changes, and actual factor events
4. Ignore recovery and session paths because one MFA event succeeded

Correct answer: C. No; examine session theft, recovery paths, enrollment changes, and actual factor events

An access incident can involve mechanisms around the factor check. Reconstruct the actual path and lifecycle rather than assume one possible cause from the outcome.

1. Widen the rule to avoid having to identify an owner or expiry
2. Remove only its description while leaving the broad allow active
3. Keep the exception indefinitely because it once helped remediation
4. Documented exception lifecycle with review/removal and negative verification

Correct answer: D. Documented exception lifecycle with review/removal and negative verification

The exception must end or receive explicit continuing justification. Verify the restored normal boundary so removal does not silently fail or leave alternate access.

1. Account incident response and appropriate resource permissions, with audit verification
2. Treat encrypted delivery as proof that the downloaded records were authorized
3. Increase transport encryption strength as the sole fix for excessive data permissions
4. Hide the service name and retain the compromised account's broad role

Correct answer: A. Account incident response and appropriate resource permissions, with audit verification

Transport protection did not constrain the account's allowed actions. Respond to the credential incident and narrow the effective data authorization under the requirements.

1. Move the affected devices into an unrestricted administration segment
2. The admission decision matches the condition; restore approved credential lifecycle and verify required access
3. Disable admission requirements for every endpoint indefinitely
4. Classify every expired-certificate classroom device as malicious without review

Correct answer: B. The admission decision matches the condition; restore approved credential lifecycle and verify required access

A secure deny can expose an operational lifecycle failure. Repair enrollment/renewal and support procedures while retaining the intended boundary.

1. Test recovery only while all ordinary identity dependencies are available
2. Publish the recovery credential so every user can resolve incidents
3. Reuse the recovery identity for routine administration without separate review
4. Protected custody, narrowly approved privileges, independent recovery path, audited use, and review

Correct answer: D. Protected custody, narrowly approved privileges, independent recovery path, audited use, and review

Recovery has its own threat and dependency model. Test the actual degraded condition and preserve accountability rather than treat the account as an unrestricted convenience.

1. Treat any historical compliant state as indefinitely fresh access evidence
2. Freshness requirements and behavior when device-state evidence is unavailable or stale
3. Ignore feed delay because the source is authoritative when available
4. Assume a managed-device label removes the need for a stale-data policy

Correct answer: B. Freshness requirements and behavior when device-state evidence is unavailable or stale

A policy input has a validity window. Specify how stale evidence affects access and verify the chosen fail behavior against both security and availability needs.

1. Verify only that the student's read now works
2. The student read task and the guest administrative denial as separate requirements
3. Use gateway reachability as proof of both role/action results
4. Verify only the guest denial while leaving the legitimate task broken

Correct answer: B. The student read task and the guest administrative denial as separate requirements

One access fix can unintentionally worsen another boundary. Use the complete matrix to correct role mapping and retain prohibited access controls.

1. List controls without mapping their effective subjects and resources
2. It links each control to a subject, resource, action, threat or requirement, enforcement point, and test
3. Judge coverage only by the number of named security products
4. Assume local-network location supplies the missing identity and permission evidence

Correct answer: B. It links each control to a subject, resource, action, threat or requirement, enforcement point, and test

A control has value when its role and effective boundary are clear. Concrete requirements and evidence let another technician evaluate coverage and remaining gaps.