Review questions

Review questions

Test your understanding with these questions. Marking and saved results are available with a free account.

1. Question 1For a booking inventory, what record demonstrates an analytical copy crossing into another account?

   Gateway address only Original account server count Cloud vendor name Job identity, destination, data and decision owner
2. Question 2A team wants to protect one report. What is the specific protect surface?

   The entire network name Report read operation and its data Every employee device Data-center address
3. Question 3Two services share a secret. Which threat increases if it leaks?

   Only print pipeline failure Lower DNS speed One service impersonating the other with its privileges Report formatting loss
4. Question 4The provider encrypts storage, but the customer grants broad decrypt rights. Who must review that role?

   Customer configuration owner Only the ISP All users Nobody because data is encrypted
5. Question 5A team compares two paths; one bypasses enforcement. What is the next decision step?

   Approve the faster path Count product names Test and close the bypass before expansion Increase log volume only
6. Question 6A nightly job has no human user. Which requester identity fits?

   Last employee account A workload identity dedicated to the job Network address only A shared admin token
7. Question 7A read request arrives after a user role change. Which attribute should determine the decision?

   Role when account was created Device color Page visit count Trusted current role at request time
8. Question 8Privilege approval expired, yet an old session still works. What test matters?

   Only restart browser Close ticket An actual request from the session after revocation Change email address
9. Question 9The engine permits requests, but a legacy service never calls it. Where is the gap fixed?

   At the service enforcement point or direct path In engine UI color In report name By repeating permit
10. Question 10Correct denials improve and p95 falls, but an export bypass appears. Do you expand?

    Yes, because p95 improved No, close and retest the bypass first Yes, if more rules exist Delete export logs
11. Question 11An older backup needs a previous key. What policy fits?

    Destroy the key immediately Grant everyone decrypt Retain bounded decrypt access for approved recovery Disable backups
12. Question 12The network permits a service to port 443; what further test is needed?

    TCP connection success only Packet size Copy count Denial of an admin operation for an unauthorized identity
13. Question 13An approved API endpoint redirects to an unapproved domain. What is the decision?

    Reevaluate the destination before sending data Always follow redirects Trust TLS alone Log and then send the request
14. Question 14An image signature validates, but its build is unknown. Which evidence is missing?

    Tag color Provenance binding digest to approved source and build Developer name only Download time
15. Question 15The database was restored, but an old identity can read it. Is recovery complete?

    Yes, rows returned Yes, if backup was encrypted No; restore the access boundary and test denial More backups suffice
16. Question 16Decision and execution counts differ. What is the first investigation?

    Edit the larger counter Trace request IDs, paths and a sample of excess events Declare confirmed exfiltration Delete incomplete events
17. Question 17After a project change, backup identity egress rises. Which signal needs examination?

    Project name alone Password length Employee count New destination, authorization and request outcome
18. Question 18An account clock is four minutes slow. What correction precedes event ordering?

    Apply clock offset with uncertainty margin Delete account logs Assume timestamps are exact Sort text alphabetically
19. Question 19A suspected identity supports a critical report. What containment is proportionate?

    Leave all rights for a day Shut all services Block the riskiest capability, test it and move work to a narrow identity Rename the identity
20. Question 20A legitimate request works after an incident, but the denial test failed because the target was down. What is recovery status?

    Full recovery Function verified, policy denial unverified Clean backup necessarily failed No negative test needed
21. Question 21Two services share an admin token. What initial migration dependency matters?

    Buy another broker only Deploy every rule Change dashboard color Separate service identities and rights before claiming coverage
22. Question 22Access control is listed, yet indexing reads full contracts. What is implementation evidence?

    Denial of full-text read by index identity with title read succeeding Framework link Number of controls Report signature
23. Question 23One option is fast but has a bypass; another is safe but breaches p95. What decision follows?

    Choose the faster option Choose the safer option regardless of latency Repair defects and compare again before expansion Average p95 values
24. Question 24An exception is closed manually, but a template restores the role. What guard test is needed?

    Check ticket only Seed a known extra role in isolation and verify denial after template deployment Trust green status Turn off logs
25. Question 25Which evidence supports closing a migration wave?

    Rule count License price Verbal approval Legitimate success and prohibited denial after a deployment cycle

Create a free account to mark your answers and save your progress.