Read. Answer. Reflect.

A. AAA

AAA combines authentication, authorization and accounting. These functions check identity, decide permitted actions and record activity; each addresses a different question in the scenario.

B. Accounting

Accounting records relevant activity for tracing and review. Successful identity checks and permission decisions do not themselves create a usable history of account actions.

C. Identity checks, permission rules and activity logs

The design covers each AAA function. Logs connect events with accounts, but additional evidence may be needed to establish who actually controlled an account.

D. Access control

Access control determines and enforces permitted access to resources. These rules govern actions on ticket records rather than simply describing or classifying those records.

A. Access-control enforcement

Identity checking does not confer every permission. A system can authenticate a user successfully while still enforcing a rule denying a particular resource action.

B. Enforce the approved resource permissions

Approved rules need mechanisms enforcing them. Logging attempts, collecting signatures or restoring damaged reports does not stop an account from performing the unapproved overwrite.

C. Access-control matrix

An access-control matrix relates subjects, objects and permitted actions. Its intersections describe access rights, rather than an inventory of assets or a sequence of lifecycle stages.

D. Subjects, objects and permitted actions

The requested relationship belongs in an access-control matrix. Ownership and acquisition information can support asset management but do not specify an account's allowed operations.

A. That editor's delete right on final editions

A matrix cell expresses a subject's action rights on an object. Remove the editor's excessive delete right; the stated draft-editing and archivist-deletion permissions do not present that violation.

B. Access review

An access review checks whether existing permissions remain appropriate and approved. It evaluates access already present rather than creating access or checking a login identity claim.

C. The review lacks effective follow-up

A recorded review must connect findings to actual follow-up. Signatures document an activity but do not demonstrate that excessive permissions were removed or otherwise resolved.

D. Review current rights and resolve exceptions

Compare current permissions with legitimate needs and approval, then track required changes. Credential changes alone do not establish that remaining permissions are appropriate and approved.

A. An account

An account is a system record representing an identity through which access can be assigned. One person may use separate ordinary and administrative accounts.

B. The active session

A session is an active interaction and can end while an account remains. Accounts, people, permissions and sessions are related but distinct concepts in access management.

C. The two accounts and their access

One employee can have distinct accounts with different permissions. Identify each relevant record rather than conflating the person, active session, permissions and all associated access.

D. Accounting

Accounting records relevant actions so they can be traced and reviewed. It differs from checking an account's identity or deciding whether a refund request is permitted.

A. Activity attributed to that account

An accounting record associates activity with an account. It does not by itself prove which human controlled shared credentials or whether subsequent handling was appropriate.

B. Relevant account-action event records

Activity records supply the accounting function missing here. Stronger login requirements or additional permission roles address different functions and do not themselves reconstruct past changes.

C. Administrative control

Administrative controls operate through organizational rules, responsibilities or processes. Approval procedures and awareness activities fit this category even when technology helps administer the work.

D. Electronic storage does not change its procedural nature

The organizational procedure is administrative in the general classification. Annex A themes use a different grouping, and storage medium alone does not determine a control's nature.

A. An assigned approval procedure

Assigning authority and a procedure addresses organizational responsibilities. Other safeguards may have value but do not define who decides exceptions or how decisions are made.

B. AI agent

The AI-enabled application coordinates steps and performs permitted actions with some autonomy. Its capabilities depend on design and permissions, rather than a single universal architecture.

C. Its actions depend on assigned capabilities

An agent label does not establish tools or authority. Agent designs and autonomy vary, so purchasing capability must be checked in the actual implementation and permissions.

D. Permit scheduling and require approval for spending

An agent can coordinate selected actions while retaining human approval for others. Its autonomy should reflect intended tasks and permissions rather than assumptions attached to its label.

A. AI drift

Changes in data or operating context can make earlier performance assumptions unreliable. This supports investigating drift without establishing that anyone maliciously manipulated the system.

B. Changed conditions require investigation

Drift can follow changes in data, context or behaviour over time. Declining quality warrants monitoring and investigation, not automatic attribution to malicious interference or a specific attack.

C. Monitor performance against the new context

The operating context has changed, so prior performance evidence may no longer transfer. Monitoring and investigation reveal whether current behaviour still supports the intended use.

D. AI trustworthiness

AI trustworthiness involves multiple context-dependent properties and their trade-offs. A fluent or accurate answer alone does not establish acceptable privacy, fairness, safety or security.

A. Accuracy alone does not settle trustworthiness

Trustworthiness is contextual and involves interacting properties. Evidence for validity or reliability does not eliminate privacy problems or establish suitability for every deployment context.

B. Relevant properties and contextual trade-offs

The decision needs evidence across relevant trustworthiness properties, including harmful bias and transparency. One attractive characteristic cannot substitute for assessing intended use and affected people.

C. An alert

An alert is a notification that an observation or rule condition may need attention. It can prompt investigation without establishing that an incident actually occurred.

D. A condition merits review

An AI-generated alert remains a notification requiring interpretation. The tool's involvement does not turn a flagged condition into proof of compromise, identity or unauthorized action.

A. Validate the notification in context

The notification calls attention to an observation that needs review. Compare the observation with the approved change and other relevant evidence before deciding whether it indicates an incident; the change alone does not settle that decision.

B. Analysis

Analysis examines and interprets information to understand patterns, relationships or causes relevant to a question. The engineer develops understanding before deciding what action is needed.

C. General analysis is broader than risk analysis

The glossary uses analysis generally for interpreting information. Risk analysis is a particular application; studying a process trend does not automatically constitute that specific risk-management step.

D. Interpret relationships across the records

Analysis connects and interprets information relevant to the delay. A count alone or an unsupported target change does not explain patterns or their contributing conditions.

A. Annex A

Annex A is the reference-control annex associated with ISO/IEC 27001. Its 2022 overview has 93 controls in four themes; applicability still requires appropriate reasoning.

B. The examples provide limited introductory coverage

The saved examples do not teach the complete control set or establish universal applicability. Detailed authorized instruction and organization-specific applicability reasoning remain separate needs.

C. Use authorized detail and document applicability reasoning

The overview is introductory, not full teaching or applicability evidence. Obtain appropriate authorized detail and connect control decisions with the organization's actual context and requirements.

D. Annual maintenance fee

An annual maintenance fee is a recurring credential-maintenance cost under the issuer's terms. It differs from an exam purchase and from learning activities that may also be required.

A. Current terms and individual entitlement

Maintenance prices and eligibility can change, and an entitlement may not cover everyone. Check current terms rather than treating an old amount or another person's waiver as transferable.

B. Check issuer maintenance fees and coverage

Learning activities and recurring payments are different maintenance matters. She should check the current terms and any applicable entitlement; completing learning alone does not establish that a fee is paid, waived or covered.

C. An anomaly

An anomaly differs from an expected pattern or reference behaviour. The deviation is a reason to investigate, not proof of compromise or a person's identity.

D. The observation departs from its reference pattern

An unusual value is an anomaly even while its cause remains unknown. A reference-pattern deviation alone does not establish malicious intent, compromise or attribution.

A. Investigate the deviation using relevant context

Anomalies need contextual investigation. Changed conditions may explain patterns, but neither the unusual order nor the promotion alone establishes its cause or identifies malicious activity.

B. An answer key

An answer key identifies intended correct answers. It can support marking without explaining choices, and its existence does not establish official status or independent validation.

C. The list records intended answers only

A key states intended answers without establishing who validated them. Editorial practice material remains separate from an official publisher key or independently checked marking scheme.

D. The key's source, currency and item mapping

A useful key must correspond to the actual questions and intended context. Familiar answers or matching totals alone do not establish the right source, edition or item mapping.

A. An application

An application performs a task for a person or organization. Scheduling is the user task, whereas the operating system manages resources and supports applications.

B. Removing the business-task application does not by itself remove the platform software

The payroll application performs a business task, while the operating system manages platform resources and supports programs. Removing one application does not by itself mean that the operating system or other applications were removed.

C. An order-management application

The missing capability is software performing the business task. Platform or connectivity changes alone do not provide an application that records orders and calculates schedules.

D. Artificial intelligence

AI systems generate outputs such as predictions, recommendations or decisions for objectives. Different designs can serve these purposes; generated text is only one possible output.

A. AI does not imply an LLM or agent

AI, machine learning, generative AI, LLMs and agents are related rather than synonymous. An AI label does not establish model architecture, tool permissions or autonomous action.

B. An AI system producing recommendations

The scenario explicitly identifies an AI system producing recommendations. Claims about language generation, agentic actions or permissions require further evidence about the actual design.

C. Assets

Assets are things of value that support organizational objectives and may need protection. Information, knowledge and services qualify alongside physical equipment and software.

D. Valuable knowledge can also be an asset

An asset need not be a purchased physical object. Specialist knowledge may support objectives and need protection even without an equipment invoice or simple purchase price.

A. Relevant information, knowledge, services and devices

The asset concept follows business value and objectives. Include relevant intangible and hosted resources as well as physical items rather than limiting attention to ownership or location.

B. An asset inventory

An asset inventory maintains relevant assets and their context. Purpose, responsible ownership and status make the record useful beyond merely counting physical devices in an office.

C. Relevant non-laptop assets are missing

An inventory should cover relevant assets, including services and data. An accurate laptop list remains incomplete when important operational resources are omitted from its scope.

D. Update asset status and responsible ownership

An inventory must be maintained to remain useful. Updating assets, status and responsible owners restores operational accuracy; adding cost alone does not resolve obsolete ownership information.

A. Asset lifecycle

The asset lifecycle spans acquisition, authorization, use, maintenance and retirement. Considering support and disposal early connects decisions across stages rather than focusing only on purchase.

B. Management across later asset stages

Acquisition is only one lifecycle stage. Assets also need appropriate authorization, maintenance and retirement arrangements as their condition and organizational requirements change over time.

C. Plan acquisition through controlled retirement

A lifecycle view connects acquisition, continued use, maintenance and retirement. Transition and disposal considerations belong alongside the purchase decision rather than being postponed until failure.

D. Asset owner

The asset owner has organizational responsibility for relevant decisions. This role need not hold legal title to the server or perform its daily technical administration.

A. Responsibility differs from legal hardware title

Asset ownership here concerns organizational decision responsibility. The school's information owner may determine use and protection while a provider legally owns or operates the infrastructure.

B. A responsible asset-owner role

Assigning an asset owner clarifies organizational decision responsibility. Technical maintenance or provider ownership does not by itself settle accountability for the dataset's appropriate use and protection.

C. Asymmetric cryptography

Asymmetric cryptography uses a related public and private key pair. Signing and verification with those members differs from mechanisms based on shared secret key material.

D. Whether that mechanism supports encryption

Not every asymmetric algorithm supports both encryption and signing. The key-pair relationship identifies the family without establishing that a particular mechanism supports every public-key operation.

A. The supplier protects its private signing key; the customer uses the corresponding suitably trusted public verification key

In this asymmetric signature arrangement, the supplier signs with its private key and the customer verifies with the corresponding public key in a suitably trusted context. Verification does not require sharing the private signing key. This does not imply that the same mechanism supports encryption.

B. Attribute-based access control

ABAC evaluates attributes of subjects, resources, actions and context. This rule combines requester, file, device and time conditions rather than relying only on a role name.

C. Enforcement of the required attribute policy

An ABAC label does not prove that the required policy is enforced. Evidence must show that relevant attributes and conditions actually affect the authorization decisions.

D. Vary relevant attributes and observe decisions

Varying relevant subject, resource and context attributes helps verify ABAC enforcement. Login success or account counts alone do not establish that conditional permission logic works.

A. Audit

An audit is systematic, independent and documented, obtaining and evaluating evidence against criteria. Routine observation alone need not possess these combined characteristics of an audit.

B. The troubleshooting check does not establish the stated audit characteristics

Records and screenshots can be useful evidence, but their use alone does not establish an audit. The proposed description needs the systematic, independent and documented evaluation against criteria required by this introductory concept. It also confers no auditor qualification.

C. Criteria, evidence collection and documented evaluation

An audit needs evidence compared with criteria through a systematic documented process. Plans, independence or evidence alone do not supply all the elements needed for defensible conclusions.

D. Audit criteria

Audit criteria are requirements or reference points used for comparison. Records and interviews may supply evidence; findings follow from comparing the evidence with those criteria.

A. The applicable audit criteria

Conformity depends on applicable requirements, not an unstated preference. Identifying criteria establishes what the evidence must demonstrate and whether weekly backup fails a requirement.

B. The applicable approval requirements

The reviewer needs the requirement against which approval timing is evaluated. Without applicable criteria, records cannot support a defensible conformity conclusion about that timing requirement.

C. Authentication

Authentication checks evidence for a claimed identity. Resource permissions and records of subsequent actions belong to separate authorization and accounting functions rather than this identity check.

D. Authentication does not grant every permission

Authentication answers the identity-check question. Authorization separately determines permitted actions, so an authenticated user may still be denied a particular operation on a resource.

A. Verify the claimed identity's evidence

Entering an existing account name states a claim; it does not check evidence for that claim. Authentication requires the relevant evidence check. Permission restrictions and logging serve separate functions.

B. Authentication factor types

Authentication factors are types of identity evidence, commonly knowledge, possession and inherence. The scenario combines distinct types rather than merely counting steps or resources.

C. Both values are knowledge factors

Two passwords remain the same knowledge factor type. Counting values or prompts does not establish authentication using more than one distinct type of evidence.

D. The separately held authentication device

The held device can supply possession evidence, distinct from knowledge of a PIN. Extra memorized secrets or repeated entry remain within the knowledge factor category.

A. Authenticator

An authenticator is a means through which evidence for an identity claim is demonstrated. Assurance depends on the mechanism, its account binding and its protection.

B. Mechanism, binding and protection affect assurance

An authenticator's assurance depends on operation, binding and protection. Possessing a product alone does not establish reliable identity checking or resolve weaknesses in its implementation.

C. Review the authenticator's binding and protection

Binding and protection affect how the authenticator supports an identity claim. Prompt counts, product claims or resource permissions alone do not establish assurance from that mechanism.

D. Authorization

Authorization determines permitted actions on resources. It can permit anonymous reading of public pages without requiring every visitor to authenticate before that authorized action.

A. Anonymous public reading can be authorized

Authorization can permit actions for anonymous requesters. Authentication is not universally required for an authorized action, although other resources may require identity checks and narrower permissions.

B. Read permission without delete permission

The decision concerns authorization for distinct actions. Granting approved reading while withholding deletion reflects that scope; identity checks or logs do not substitute for resource permissions.

C. Availability

Availability concerns authorized access and use when needed. The scenario does not establish unauthorized disclosure or inaccurate records; the immediate failure is timely usable access.

D. Public reachability does not prove needed availability

Availability must relate to the required information or service and authorized use. A working public page does not establish that staff can use a separate scheduling function.

A. Test usable authorized access during required periods

Availability includes usable access when authorized parties need it. Connection checks, accurate data and approved permissions alone do not show that the required document task can be completed.

B. A backup

A backup is a retained copy intended to support information recovery. Its purpose differs from permissions, signatures or an agreed reference configuration for a system.

C. Restoration capability remains unproven

A copy's existence does not demonstrate successful restoration or achievement of recovery objectives. Recovery needs evidence that the retained information can actually be restored as required.

D. Restoration of usable data against recovery needs

A restoration check tests whether retained copies provide usable recovery. Successful copy jobs, expected file names or retention settings alone do not demonstrate the required recovery outcome.

A. Blue team

The blue-team function protects, detects and responds. The adversarial exercise role is distinct; collaborative work between those functions may instead be described as purple-team work.

B. The defensive function need not be a separate department

Blue team describes a defensive function rather than a required organizational structure. Existing staff can perform it, but the label itself does not demonstrate effective protection.

C. Assign staff to monitor, investigate and respond

Monitoring, investigation and response establish the blue-team function. Testing adversarial objectives alone does not provide organized defensive handling of what the exercise reveals.

D. Bluetooth

Bluetooth is a short-range wireless technology family including Classic and Low Energy. Its family name describes connectivity, not a guarantee about the security of a specific connection.

A. The actual connection and device security

The Bluetooth name does not establish secure configuration or device behaviour. Actual implementation and connection conditions need assessment rather than assuming the technology label proves protection.

B. That both devices support the variants and functions needed for the proposed use

Bluetooth is a family including Classic and Low Energy. The devices' actual radio capabilities and use context determine supported functions, so the common family label is insufficient for the proposed arrangement. Capability checks also do not replace security assessment.

C. Broad network access

Broad network access makes cloud capabilities available through standard network mechanisms. It concerns access mechanisms rather than resource metering, pooled capacity or expansion and contraction.

D. Network reachability does not imply public resource access

Broad network access concerns how capabilities are reached. Authorization can still restrict resources, so the characteristic does not mean every record is publicly accessible.

A. Supported access through standard network mechanisms

The question concerns broad network access. Usage metering, elasticity and pooling support other cloud characteristics but do not directly establish supported standard network access.

B. Business continuity

Business continuity maintains or resumes important business activities during disruption. It can include people, locations and workarounds while technical recovery proceeds as one supporting component.

C. Business continuity extends beyond technology restoration

Continuity concerns important business activities, including their dependencies beyond IT. Restoring technology supports that objective but does not prove that essential operations can actually resume.

D. Arrange a workable way to handle priority cases

Continuity decisions focus on maintaining or resuming important activities. Approved alternative working arrangements can support those activities while technical restoration continues according to business needs.

A. Business impact analysis

Business impact analysis examines disruption effects on activities, dependencies and recovery priorities. It informs business recovery needs rather than merely discovering technical weaknesses or granting access.

B. Effects on activities, dependencies and recovery priorities

A technical weakness scan is not a business impact analysis. The missing work connects disruption to business activities, dependencies and the resulting priorities for recovery.

C. Disruption consequences and relevant dependencies

Business impact analysis supports recovery priorities by examining consequences and dependencies. Equipment price or managerial preference alone does not establish which business activity requires earlier recovery.

D. Cause analysis

Cause analysis investigates why a problem happened and what conditions contributed or sustained it. It supports understanding recurring failures beyond repairing individual incorrect requests.

A. Investigate contributing conditions without a fixed recipe

Cause analysis should investigate actual contributing conditions. Neither automatic blame, predetermined retraining nor a fixed number of questions guarantees an adequate explanation of the problem.

B. Investigate the conditions sustaining recurrence

Understanding recurring errors requires investigating relevant conditions and relationships. Predetermined blame or repeating repairs can leave the actual contributing cause in place and allow recurrence.

C. Certification audit

A certification audit is an independent organizational assessment through the certification route. A person's training award is separate from certification of the organization's management system.

D. The personal award does not establish those claims

A personal Foundation certificate neither certifies an organization nor authorizes its holder to act as a certification body. Organizational certification follows a separate assessment route.

A. A separate organizational certification route is needed

Introductory staff learning and organizational certification are distinct. The business needs the relevant independent certification process rather than treating personal study or routine checks as certification evidence.

B. Chain of custody

Chain-of-custody records track evidence collection, handling, transfer and control. They support provenance and integrity rather than merely recording an asset's acquisition or operational value.

C. Records of evidence handling and control

Asset records do not replace custody records of handling and transfers. The appropriate evidence process depends on context, but provenance and control require relevant supporting information.

D. Record the transfer, custodians and relevant conditions

Recording transfers and control supports evidence provenance and integrity. Inventory presence or one collection timestamp does not establish how the evidence was handled throughout later movement.

A. Change management

Change management controls changes through planning, approval, implementation, verification and records. The sequence connects authorized intent with actual implementation and evidence of its outcome.

B. Approval alone does not verify the implemented change

Approval establishes permission to proceed, not successful implementation. The change needs appropriate verification and records showing whether the actual result meets the intended outcome.

C. Approve, implement, verify and record the change

A controlled change connects planning and approval to implementation, verification and records. An announcement or absence of complaints does not demonstrate the required operational result.

D. CIA triad

The CIA triad covers confidentiality, integrity and availability. The goals address authorized disclosure, accuracy and completeness, and usable access at the time required.

A. Several CIA objectives can be affected

One event can affect confidentiality, integrity and availability together. Disclosure, damaged records and interrupted authorized use demonstrate distinct effects rather than mutually exclusive categories.

B. Record accuracy and needed authorized access

Confidentiality is one core objective. Integrity and availability add protection of accuracy and completeness and needed authorized use, creating coverage across the CIA triad.

C. Clear

Clear applies logical techniques to user-addressable storage against simple recovery through ordinary interfaces. It is distinguished from advanced-laboratory recovery resistance and making the medium unusable.

D. Use an appropriate paper-media process; Clear is the logical storage concept here

The saved Clear concept concerns logical treatment of user-addressable storage, not a paper-media method. A suitable authorized paper-media process must be determined separately; the glossary supplies no universal technique or overwrite recipe.

A. The logical treatment must address target data in user-addressable storage against simple interface-based recovery

Clear concerns logical treatment of user-addressable storage against simple recovery through ordinary interfaces. Merely hiding filenames while leaving the data readable does not establish that outcome. A supported method suitable for the medium is still needed; this is not a technique prescription.

B. Cloud computing

Cloud computing is characterized by on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. These characteristics describe the service model rather than its security outcome.

C. The model does not establish security or compliance

Cloud characteristics identify a computing model. They do not demonstrate customer compliance or secure implementation; those conclusions require relevant evidence about obligations, responsibilities and controls.

D. The full set of five characteristics

The model combines five characteristics rather than merely remote servers or network access. Review the full set before inferring that the saved cloud-computing description applies.

A. Collision resistance

Collision resistance concerns finding any two distinct inputs sharing a hash output. Preimage resistance starts with a digest, while second-preimage resistance fixes a particular original input.

B. Finding collisions is difficult, not impossible in principle

Collision resistance is computational resistance to finding collisions, not a promise that collisions cannot exist. Hash outputs also do not by themselves establish the supplier's identity.

C. Efficient construction of distinct matching-digest inputs

Efficient construction of a colliding pair weakens confidence in collision resistance. Fixed output length, a known digest or the possibility of collisions does not alone show they are easy to find.

D. Communication

Communication provides relevant information to an intended audience for a defined purpose. The scenario connects recipients, content and intended action rather than merely storing information.

A. The intended audience and operational purpose have not been served by the information provided

Communication provides relevant information to an intended audience for a purpose. Uploading logs does not demonstrate that branch managers received useful workaround instructions. This introductory concept still does not supply the complete ISO communication-planning requirements.

B. Relevant instructions for that audience and purpose

Useful communication matches information to its intended audience and purpose. A general announcement, unannounced procedure or unexplained change record may fail to tell contractors what action is required.

C. Community cloud

A community cloud serves a defined community of organizations with shared concerns. It differs from exclusive single-organization use and from a general-public provider offering.

D. Assess the actual security arrangements

A deployment label describes who the infrastructure serves, not a proven security level. Relevant safeguards and obligations require assessment of the actual arrangement and implementation.

A. That the infrastructure serves the defined community and its shared concerns, rather than relying on separate customer accounts alone

Community cloud concerns infrastructure for a defined community of organizations with shared concerns. Several customer accounts in a general-public offering do not by themselves establish that deployment arrangement. Its security still requires separate assessment.

B. Competence

Competence is the ability to apply relevant knowledge and skills to achieve intended results. The observed task demonstrates application rather than merely participation in learning.

C. Attendance alone does not demonstrate competence

Learning participation can support development, but competence concerns applied ability. Attendance or a certificate alone does not show that a person can achieve the intended task outcome.

D. Demonstrated correct performance of the task

Demonstrated correct performance addresses the ability to apply knowledge and skills to the intended work. Attendance, course completion and possession of a badge document learning or an award, but do not alone establish that practical ability.

A. Compliance

Compliance concerns meeting applicable requirements and demonstrating that they are met. Both identifying obligations and evidence of actual fulfillment matter in the organization's context.

B. Applicable requirements were not established in context

Compliance depends on requirements applicable to the organization and context. A borrowed checklist can omit relevant duties or include irrelevant ones, so possession alone establishes little.

C. Evidence that actual access meets the requirement

Demonstrating compliance requires evidence of meeting the applicable duty. A policy states expectations, but it does not by itself show that actual access was approved as required.

D. Computerized adaptive testing

Computerized adaptive testing adjusts item selection using an estimate of performance as testing proceeds. A changing selection process differs from presenting every learner with a fixed sequence.

A. Scaled scores and current format rules need separate interpretation

A scaled score is not a raw percentage. Exam length, navigation and format are issuer-specific and changeable, so current rules must be checked rather than inferred from this glossary.

B. Performance-informed selection can produce different item sequences; the difference alone does not prove a fault

CAT uses an estimate of performance to adjust subsequent item selection, so different responses can lead to different sequences. Sequence differences alone neither establish a malfunction nor determine a raw percentage. Actual scoring, length and navigation rules remain issuer-specific.

C. Confidentiality

Confidentiality limits information access and disclosure to authorized parties. The immediate issue is unauthorized reading, while accuracy and needed access are not shown to have failed.

D. Unauthorized disclosure can harm confidentiality without alteration

Confidentiality and integrity address different objectives. A list may remain accurate and complete while its disclosure to an unauthorized recipient violates the intended access boundary.

A. Restrict drawing access to authorized recipients

Restricting access and disclosure to approved recipients directly supports confidentiality. Availability and unchanged copies are useful for other objectives but do not establish the intended disclosure boundary.

B. Configuration baseline

A configuration baseline is an agreed reference state for system settings. It provides a comparison point rather than merely recording an individual change or notification.

C. The baseline needs maintenance and suitability review

A baseline is a maintained reference, not a permanent security guarantee. Its settings must remain appropriate as requirements, technology and operating conditions change over time.

D. An appropriate agreed configuration baseline

An agreed, appropriate baseline supplies the reference for comparing configurations. A current snapshot without review, login history or acquisition records does not establish the intended settings.

A. Configuration management

Configuration management maintains knowledge and control of system settings and changes. It includes ongoing oversight rather than only naming one agreed reference configuration or recording asset prices.

B. Ongoing configuration management

A baseline defines an agreed reference state. Configuration management maintains knowledge and control of actual settings and changes, addressing the retailer's inability to explain its operational state.

C. Record and control the relevant settings and changes

Configuration management requires maintained knowledge and control of settings and changes. Service restoration alone does not leave a reliable account of the current state or its authorized changes.

D. Continual improvement

Continual improvement is recurring activity to improve results or the management system over time. It goes beyond fixing one detected issue or completing one isolated task.

A. Improvement is broader than a single correction

A correction addresses a detected problem. Continual improvement involves recurring efforts to improve results or the management system, so one repair does not establish the broader practice.

B. Improvement actions with reviewed outcomes over time

Continual improvement needs attention to results across recurring cycles. Completed activities or more documents alone do not show that the management system or its outcomes are improving.

C. Continuing professional education

Continuing professional education concerns learning and development recorded under credential-maintenance requirements. It is distinct from an initial examination purchase or organizational certification assessment.

D. The glossary does not award or verify maintenance credit

The glossary provides introductory learning material, not an award of CPE credit or proof of completed maintenance duties. Applicable issuer requirements and accepted evidence remain separate.

A. Applicable learning-credit and evidence requirements

CPE is tied to the credential's maintenance requirements. Another attendee, a relevant-sounding title or an organizer's certificate alone does not establish issuer acceptance or the required evidence.

B. A control

A control is a measure used to influence risk or help meet a security objective. The approval requirement is the safeguard, distinct from the risk being addressed.

C. Existence alone proves neither effectiveness nor universal need

Controls require contextual selection and evaluation. A measure's presence does not show that it works as intended or that the same measure is needed by every organization.

D. Relevant risk, objective and observed results

A control should connect to relevant risk or objectives and be assessed for its result. Popularity, labels and document counts do not establish contextual suitability or effectiveness.

A. Control themes

Control themes are the four 2022 Annex A groupings: organizational, people, physical and technological. They are a classification scheme, not distinct login evidence or cloud capabilities.

B. Annex A themes differ from general control categories

The selected Annex A overview uses four themes. Administrative, technical and physical are general control categories from a different scheme, so the sets should not be conflated.

C. People

Staff awareness and training is a people-theme example in the selected overview. The question uses the four Annex A themes; calling the safeguard administrative in a different general scheme would not answer the worksheet's theme question.

D. Correction

A correction addresses a detected problem or nonconformity. Removing the specific permission repairs that instance but does not establish that its underlying cause has been removed.

A. Repairing an instance does not necessarily remove its cause

Correction fixes a detected problem, while corrective action addresses a cause to prevent recurrence. The repaired address alone does not establish that future errors are prevented.

B. Resolve the specific unapproved request appropriately

The correction addresses the particular detected request. Investigating conditions or redesigning the process may support cause analysis and corrective action, which serve a different purpose.

C. Corrective action

Corrective action addresses a cause of nonconformity to prevent recurrence. Changing the faulty rule targets the recurring mechanism rather than merely removing one excessive permission.

D. Effectiveness of the corrective action

Implementation alone does not demonstrate effectiveness. The team needs suitable follow-up evidence showing whether the action addressed the cause and prevented the targeted recurrence.

A. Check whether required reviews now occur reliably

Corrective-action follow-up evaluates whether the cause-focused change achieves its intended effect. Documents and assignments show implementation but do not alone demonstrate reliable prevention of recurrence.

B. Correlation

Correlation relates observations to help interpret events or activity. The linked records may support investigation without independently establishing why the events occurred or who caused them.

C. Related observations do not establish causation

Correlated observations can indicate a relationship worth investigation. They do not by themselves establish causation, the direction of an effect or attribution to an actor.

D. Relate the records and investigate remaining uncertainty

Relating observations across the records can help interpret the sequence and possible relationships. The resulting correlation supports further investigation; it does not by itself establish causation or attribution.

A. A cryptographic hash

In this fixed-output example, the specified cryptographic hash function computes a digest from the package. The result is a cryptographic hash value used for content comparison, not a recoverable encrypted copy or a secret key. The output-length statement here concerns the specified function.

B. Neither identity proof nor reversible encryption follows

A hash is not reversible encryption, and a bare supplied hash does not authenticate the supplier. Its use for checking data must be interpreted within the evidence context.

C. The file has not passed the expected-content comparison and the discrepancy needs investigation

A different computed digest does not match the independently trusted expected content value. Investigate the file, reference and comparison process before relying on the release. A bare hash neither identifies an attacker nor provides reversible recovery of the file.

D. A cryptographic key

A cryptographic key controls a cryptographic mechanism's operation. Protecting and managing that parameter contributes to the protection the overall mechanism can actually achieve.

A. Key protection affects achieved security

Key protection and lifecycle management influence the protection actually achieved. Deploying a mechanism does not remove the need to manage access to its controlling key material.

B. Cryptographic key lifecycle management

Key protection and lifecycle affect the protection achieved. A product label, successful demonstration or visible ciphertext alone does not establish appropriate management of the controlling key material.

C. Cryptography

Cryptography includes methods using mechanisms such as encryption, hashes and signatures. These mechanisms serve different purposes rather than all providing identical forms of information protection.

D. The introduction supplies no deployment-selection checklist

The glossary introduces cryptographic concepts without providing current algorithm-selection, key-size or deployment guidance. Production choices require suitable authoritative detail beyond the saved introductory material.

A. Consider the different cryptographic mechanisms by purpose

Cryptography contains mechanisms with distinct purposes. Conceptual selection should distinguish encryption, hashing and signatures without assuming that any one automatically satisfies all protection objectives.

B. Cyber threat intelligence

Cyber threat intelligence is information analysed and contextualized to support decisions about cyber threats. The interpretation and organizational relevance distinguish it from an isolated raw indicator.

C. Analysis and context for decisions

A raw indicator alone is not a complete intelligence assessment. Analysis and context are needed to explain relevance, uncertainty and implications for the decisions being supported.

D. Contextualized assessment supporting that decision

Threat intelligence supports decisions by connecting analysed information to relevant context. Raw lists or headlines do not explain the organization's exposure, and intelligence does not guarantee future events.

A. A dashboard

A dashboard concisely displays selected information and measures for monitoring or decisions. Its usefulness depends on the quality, context and interpretation of what is shown.

B. The display does not prove security

Dashboard appearance is not proof of security. Missing or stale information undermines interpretation, so underlying quality, selection and context matter more than a favorable color.

C. Data quality, context and understandable measures

Dashboard decisions need interpretable, trustworthy information. Clear definitions, reporting context and data quality resolve the stated problems; indicator totals, green status or uniform chart scales alone do not.

D. Data classification

Data classification assigns information to categories that guide handling and protection. Handling, masking and retention concern how information is treated rather than the category-assignment decision described here.

A. The scheme must fit the organization's context

A classification scheme should fit the organization and its obligations. Borrowed categories may be unsuitable, and assigning a category does not itself implement the needed protections.

B. Appropriate handling and protection expectations

Classification exists to guide handling and protection. Connecting the category to appropriate expectations makes it operational; a name or decorative treatment alone does not establish those protections.

C. Data handling

Data handling concerns actions and protections across information collection, use, storage, transfer, retention and disposal. It extends beyond merely naming a classification category or one storage mechanism.

D. Other relevant stages of information handling

Handling spans multiple information activities, not only transfer. Appropriate use, storage, retention and disposal arrangements may still be necessary even when a transfer step is well controlled.

A. Define actions and protections across the information lifecycle

End-to-end handling addresses how information is used and protected through relevant stages. Collection alone, a label or indefinite retention does not supply those practical arrangements.

B. Data masking

Data masking changes the displayed or supplied representation to limit exposure of selected values. It does not necessarily encrypt originals or establish that all identifying information is removed.

C. Masking alone does not establish anonymization

Masking can reduce exposure without achieving effective anonymization. Remaining information and context may still identify people, and masking is not automatically encryption or an access-control mechanism.

D. Show a suitably limited representation

Masking the supplied representation addresses unnecessary display exposure. It should be considered alongside appropriate access and handling rather than treated as a substitute for every other protection.

A. Data poisoning

Data poisoning involves adversarial manipulation of training data intended to affect AI behaviour. Direct manipulation of a model or its training updates is the distinct model-poisoning concept.

B. Changed context alone does not establish poisoning

Data poisoning requires adversarial training-data manipulation intended to affect behaviour. Performance changes under a new context can warrant investigation without proving that manipulation happened.

C. The batch presents a data-poisoning concern that must be addressed before relying on it as training input

Deliberate manipulation of training examples intended to affect model behaviour fits the data-poisoning concern. The batch cannot be treated as ordinary representative data solely from its format. This conceptual decision neither supplies attack procedures nor proves that every output is wrong.

D. Decryption

Decryption recovers readable information from ciphertext through the appropriate cryptographic process and key. Hashing is not reversible encryption, and classification does not recover encrypted contents.

A. Recovered plaintext still needs appropriate handling

Successful decryption restores readable information but does not remove handling obligations or authorize further disclosure. The resulting plaintext still requires protection appropriate to its purpose and context.

B. Decrypt appropriately and protect the resulting plaintext

Appropriate decryption obtains readable data, which still needs suitable handling. Hashes are not reversible copies, recovery does not authorize wider sharing, and labels do not recover ciphertext.

C. Defense in depth

Defense in depth combines complementary safeguards to reduce exposure and support detection and response. Different layers address different parts of protection rather than duplicating one identical function.

D. Layered safeguards do not guarantee universal prevention

Defense in depth reduces exposure through complementary measures, but no layer or combination guarantees every attack will be stopped. Installation alone also does not establish effectiveness.

A. Relevant monitoring and recovery capability

Monitoring and recovery complement preventive restrictions by supporting detection and response. Repeating a rule does not supply those missing capabilities or guarantee attacks will be prevented.

B. Demilitarized zone

A demilitarized zone separates exposed services from other protected systems through controlled communication paths. The intended separation depends on actual architecture and enforced policy.

C. The intended communication policy is not enforced

A zone name does not enforce policy. Controlled communication paths must implement the intended separation; an unrestricted path can undermine protection even when the diagram has the expected label.

D. A separate zone with controlled communication paths

A DMZ design separates exposed services and controls communications with protected systems. Labels or unrestricted placement do not create the intended boundary or enforce its policy.

A. Dependencies

A dependency is something a service, process or asset relies on to work. Dependencies can include people-related arrangements, information, connectivity and external providers rather than only equipment.

B. A dependency needed for the service to work

The identity service is a dependency because enrollment relies on it. Restoring an isolated component does not make the wider activity usable when another necessary resource remains unavailable.

C. What must work for label printing to work?

Dependencies are resources and arrangements required for operation. Purchase cost, legal ownership or contract age does not establish what the printing service relies on to work.

D. Deprovisioning

Deprovisioning removes or disables access and identity/account arrangements that are no longer justified. The handling should fit the context, including permissions, credentials and active access paths.

A. Handle obsolete rights and account state in context

A role move does not universally require deleting the entire account. Remove obsolete access and consider account state, downstream permissions, sessions, tokens and audit retention appropriately.

B. Remaining sessions, tokens and downstream permissions

Deprovisioning needs context-specific handling of remaining access arrangements. Disabling one account record does not by itself establish that sessions, tokens and downstream permissions are appropriately resolved.

C. Destroy

Destroy combines advanced-recovery resistance with making the medium unusable. Purge may allow reuse, while Clear addresses simple recovery through ordinary interfaces using logical techniques.

D. The stated outcome does not establish Destroy, which includes making the medium unusable

In the saved NIST concept, Destroy combines resistance to advanced laboratory recovery with an unusable medium. The label is not established by an overwrite report when usability remains. This does not prescribe a technique or authorize destruction of real records.

A. It makes the medium unusable

Destroy makes the medium unusable, conflicting with required reuse. This conceptual distinction helps assess an option without prescribing a technique or authorizing destruction of actual records.

B. Digital signature

A digital signature uses private signing and corresponding public verification keys to support integrity and origin evidence. The public key's relevant trust context matters to interpretation.

C. Verification does not establish those guarantees

A signature normally does not conceal a document, verify all its claims or guarantee a legal result. Integrity and origin evidence must be distinguished from those broader conclusions.

D. The verification key's relevant trustworthiness

Verification requires the appropriate public key in a suitably trusted context. A familiar channel, visible graphic or calculation with an arbitrary supplied key does not establish the source-key relationship.

A. Disaster recovery

Disaster recovery restores technology and data after disruption in support of business needs. Confirming usable operation matters beyond merely restoring files or turning on a server.

B. Technology recovery supports broader business continuity

Disaster recovery is part of broader continuity. Restoring technology and data may be necessary but does not address every arrangement needed to maintain important business activities.

C. Usable application and data operation against business needs

Recovery concerns restored technology and usable data supporting the business. File presence, power or administrative closure alone does not demonstrate that the required service works.

D. Discretionary access control

Discretionary access control allows specified permission decisions to be made or delegated by authorized subjects. The discretion operates within applicable policy rather than granting unlimited freedom.

A. Discretion can exist within policy limits

DAC permits specified decisions by authorized subjects within the applicable policy. A boundary on permitted sharing does not eliminate all discretion or imply unrestricted permission authority.

B. Delegate bounded file-sharing decisions to owners

Bounded delegation of permission decisions fits discretionary access control. The model does not require unlimited authority, universal public access or conclusions about legal ownership of resources.

C. Documented information

Documented information includes controlled and maintained information together with its medium. Procedures and retained records can qualify in electronic forms; paper is not a required format.

D. Electronic forms can qualify when appropriately controlled and maintained

Documented information need not be a paper manual. Controlled procedures and managed retained records can be electronic, together with their medium. Their format alone neither disqualifies them nor proves that the complete required-record set has been supplied.

A. Controlled information and its associated medium

The concept centers on controlled and maintained information with its medium, not a mandatory paper format. Both the wiki and approval records need appropriate management in their context.

B. Domain Name System

DNS is the distributed naming system involving domain names, resource records, authoritative servers and resolvers. It supports locating relevant destinations rather than itself providing every application's transport behaviour.

C. One name need not mean one address or website

DNS relationships are not universally one-to-one between a name, an IP address and a website. The naming system uses relevant record types and service arrangements.

D. Resolver queries and authoritative DNS records

Name resolution involves resolvers obtaining appropriate DNS records. The evidence directs investigation toward that path rather than identity evidence, file permissions or unrelated transport settings.

A. Due care

Due care concerns reasonable conduct expected under comparable circumstances and competence. The focus is how responsibly the administrator acts, rather than a universal fixed sequence of activities.

B. Care is not confined to a universal after-only stage

The glossary does not impose a universal before-and-after timeline. Due care concerns reasonable conduct, and relevant protective actions can occur throughout responsible work in context.

C. Check the recipient approval and apply the relevant safeguards before releasing the export

Due care concerns reasonable conduct appropriate to the circumstances and competence. Checking the unexpected recipient and following the relevant safeguards addresses the known concern; a deadline, experience or encryption alone does not resolve it. No universal care-after-diligence timeline is implied.

D. Due diligence

Due diligence is prudent and thorough investigation, analysis or review relevant to a decision or responsibility. The supplier work examines evidence rather than merely accepting claims at face value.

A. Diligence is not limited to a universal before-only stage

Due diligence concerns appropriate investigation and review, not a universal before-and-after sequence. The introductory definition also does not substitute for legal advice on specific circumstances.

B. Investigate relevant capabilities and supporting evidence

Due diligence calls for relevant, thorough investigation and analysis. Advertising claims alone do not establish capabilities, so the decision needs suitable evidence in its intended service context.

C. Dynamic application security testing

DAST tests a running application and its behaviour. Static testing examines code or related artifacts without executing the target application, so the running target is the key distinction here.

D. The report does not establish the required running-application testing

DAST examines a running application and its behaviour; examining source without executing that target is static work. The report can complement, but cannot establish completion of, the requested running-application test. Any actual testing still needs the appropriate authorization.

A. Observe the running staging application's responses

DAST addresses behaviour of the running application within authorized test conditions. Static code review can complement it but does not directly observe that execution behaviour.

B. Effectiveness

Effectiveness is the extent to which intended results are achieved. The focus is whether the control meets its objective, rather than how many activities occurred or resources were used.

C. Completion alone does not establish effectiveness

Activities can be completed without achieving intended results. Effectiveness needs evidence relating outcomes to the objective, not merely confirmation that the planned sessions took place.

D. Observed recovery outcomes against the target

Effectiveness concerns achievement of the intended recovery result. Holding exercises, completing tasks or spending staff hours does not alone show that usable restoration meets the target.

A. Efficiency

Efficiency relates achieved results to resources used. When comparable outcomes are obtained with less effort or cost, that relationship is more favorable for the method described.

B. Lower resource use alone does not prove effectiveness

Efficiency considers results in relation to resources. Using fewer resources alone does not establish effectiveness, especially when unresolved permissions indicate that the required result may not be achieved.

C. Achieved results relative to resources used

Efficiency connects achieved results with resources used. Timeliness, report counts or costs considered alone do not establish that relationship when effort and required quality are omitted.

D. Elevation

NIST SP 800-61r3 RS.MA-04 says elevation usually involves higher management in response efforts; escalation generally concerns increasing resources or time frames. In this scenario the missing need is management authority. Local plans and actual roles should still be checked.

A. Distinguish NIST usage and verify local authority roles

The saved NIST usage distinguishes elevation from escalation, while local plans may use different terms. Actual responsibilities and authority must be checked rather than inferred solely from wording.

B. Involve the higher management decision-maker

The missing need is the executive's management authority, which fits elevation in the selected NIST usage. Additional expertise, capacity or analysis time may support response but do not supply that decision authority. Actual local roles and terminology must still be verified.

C. Embedded system

An embedded system integrates computing into a device for particular functions. The controller's dedicated equipment role fits, without implying that every embedded system has the same connectivity or industrial context.

D. The concepts can overlap without being synonyms

Embedded systems, IoT and ICS can overlap, but are not synonymous. Dedicated integrated computing does not by itself establish network connectivity or an industrial-control setting.

A. Record the integrated computing and its device function, and check connectivity and operational context separately

Computing integrated for the instrument's measurement function supports describing an embedded system. The record should capture that function without assuming IoT connectivity or an ICS context; those related concepts need their own evidence.

B. Encapsulation

Encapsulation adds relevant protocol information as data moves through the network stack. It structures how the application message is carried. That is different from resolving a name, cryptographically concealing content or separating network zones.

C. Protocol wrapping alone does not establish secrecy

Encapsulation concerns protocol structure, not inherently confidentiality. Adding relevant network or transport information does not by itself demonstrate that content has been cryptographically concealed.

D. The stack can add protocol information to carry the message without that alone proving a business-content change

Encapsulation places the message within the relevant protocol structures as it moves through the stack. Added transport or network information does not alone demonstrate altered application content or encryption. This is a conceptual distinction, not a packet-analysis or fragmentation procedure.

A. Encryption

Encryption transforms readable information into ciphertext with appropriate cryptographic recovery. Hashing is not reversible encryption, and masking changes a representation without necessarily providing cryptographic protection.

B. Encryption establishes neither approval nor endpoint security

Encryption can protect information in a defined context, but it does not authorize disclosure or secure every endpoint. Recipient approval and endpoint conditions need separate consideration.

C. Use appropriate encryption plus approved handling

Encryption provides confidentiality protection for the transfer, while approved handling and endpoint safeguards still matter. An approved recipient alone does not conceal the transfer, and a bare hash cannot substitute for encrypting the records.

D. End of life and end of support

These supplier lifecycle milestones concern retirement or the end of support and maintenance. Their exact meaning and relationship depend on the product, supplier terminology and actual support arrangement.

A. Verify product terms and actual support arrangements

End-of-life and support milestones are not universally identical. Product details, supplier terminology and the actual maintenance agreement must be checked before drawing operational conclusions from a notice.

B. Verified milestones, support terms and business context

The concept prompts a replacement or exception decision based on verified lifecycle and support details. A milestone does not by itself prove immediate failure or an existing compromise.

A. Escalation

Adding specialist response resources fits escalation in this selected NIST usage. Involving a higher management level would instead illustrate elevation.

B. Escalation

Increasing the response time frame fits escalation in the selected NIST note. Elevation concerns involving a higher level of management; no such change is stated here.

C. The actual plan and authority arrangements

Terminology can vary between organizations. The local plan and authority arrangements determine how the resource request should be handled, even when studying NIST's terminology.

B. Evaluation

Evaluation judges results against criteria. Recording 70 minutes determines a value; comparing it with the agreed target adds the evaluative step.

C. Judge results against the objective

A count can support evaluation, but evaluation requires judging the information against relevant criteria or objectives. Counting alone does not establish success.

D. Evaluation

Management is judging observed results against approved criteria. This is general evaluation; the case does not establish the full ISO performance-evaluation requirements.

C. False negative

The relevant condition is present but the scanner misses it. A false positive would incorrectly report a condition that was absent.

D. False negative

The confirmed malicious login was not detected, so this is a false negative. The harmless job flagged as malicious would be the false positive.

A. A missed weakness remains possible

A clean result does not prove absence of weaknesses. False negatives are possible, but their possibility does not establish that this particular result is wrong.

D. False positive

The activity occurred, but the detector incorrectly classified it as malicious. A false positive concerns the target condition, not whether any underlying event happened.

A. False positive

The scanner reports a weakness that is absent in the checked context. A false negative would miss a weakness that was actually present.

B. The event can be real despite misclassification

An incorrect malware classification does not erase the underlying event. Keep the distinction between what happened and whether the detector's target condition was present.

A. Firewall

A firewall enforces a communication policy through allow and block rules. A monitor observes traffic, a routing table directs forwarding, and a VPN provides a tunnel; those roles alone do not establish the stated policy enforcement.

B. The product's actual filtering capabilities

Firewall capabilities vary. Packet, session, application-aware and host application controls are not identical, so the actual offered enforcement must be examined.

C. Effective enforcement of the communication policy

The definition concerns enforcing network policy. A written intention alone does not establish that the mechanism actually permits and blocks the intended paths.

B. First-party audit

An audit conducted on the organization's own behalf is first party, even when the auditor is an external consultant. Employment status alone does not determine the category.

C. First-party audit

The manufacturer conducts the audit for itself. That relationship makes it first party; competence and impartiality still need attention within the internal audit arrangements.

D. The charity's own commissioned audit

The party on whose behalf the audit is conducted determines the distinction. The charity's own audit can be first party despite using a consultant.

C. Framework

A framework structures reasoning and coordination. Organizing outcomes does not by itself create a law, certification or complete recipe for implementation.

D. A framework does not automatically confer certification

A framework is an organizing structure. Certification requires its own applicable route; merely choosing a framework does not establish that an award has been earned.

A. An appropriate cybersecurity framework

A framework helps coordinate reasoning about a subject and its outcomes. Individual logs, secrets and copies may support operations but do not provide that organizing structure.

D. Generative AI

The model produces derived synthetic content. Generative AI can generate images and other media; it is not limited to language models or text.

A. Plausible generated text needs verification

Generative output can look plausible without being verified. The team must check the promise against authoritative information before treating the draft as accurate.

B. Generative models can also produce audio

Generative AI includes synthetic audio as well as text, images and video. The broader category does not require every model to be a language model.

A. Governance

Direction, accountability and oversight characterize governance. Technical operations may implement decisions, but this case focuses on who directs the work and reviews results.

B. Assign decision accountability and oversight

Governance connects organizational direction with accountable decisions and oversight. Another product alone does not assign responsibility or resolve how priorities are decided.

C. Leadership's review and accountability

The leadership activity provides direction and oversight with accountability. Installation and rebooting are operational actions that can support the resulting decisions.

B. Governance, risk and compliance

The decision links accountable direction, uncertainty about consequences and applicable requirements. These are related GRC functions, rather than one interchangeable technical task.

C. Risk reasoning

The owner addresses accountability and the requirements address compliance. Risk reasoning considers uncertainty and consequences, completing the three connected perspectives in this case.

D. Compliance does not replace governance and risk work

GRC connects distinct functions. Meeting an obligation can be important, but it does not replace accountable direction or decisions under uncertainty.

C. Hardware

Hardware consists of physical computing components. Programs are software, while the meaningful content they process is information.

D. Hardware

A memory module is a physical part of a computing system, making it hardware. Permissions and instructions are not physical components.

A. The physical drive remains hardware

Hardware means the physical computing parts. Removing stored content changes what the drive holds; it does not remove the physical drive or turn it into software. The case does not prescribe a sanitization method.

D. Hybrid cloud

The arrangement combines distinct cloud infrastructures that remain unique and are bound by technology enabling data and application portability. The stated movement of workloads and data supplies that condition. One private or one public cloud alone would not capture the case.

A. Actual responsibilities and trust boundaries

Hybrid cloud describes an arrangement of cloud infrastructures. Detailed responsibilities and trust boundaries still depend on the actual connected services and arrangements.

B. A bound composition of distinct cloud infrastructures enabling data and application portability

In NISTSP800-145, distinct cloud infrastructures remain unique but are bound by technology that enables data and application portability. Possessing two subscriptions alone does not establish that condition.

A. Identity and access management

IAM coordinates identities and their access across definition, provisioning, review and removal. The case describes that wider lifecycle rather than one isolated login check.

B. Review and update access as duties change

Authentication checks identity evidence, but IAM also coordinates access over time. Role changes need review and appropriate adjustments to permissions.

C. Identity and access management

IAM covers coordination of identity and access arrangements, including service identities. Closing obsolete access belongs to that lifecycle, beyond merely authenticating current users.

B. Identity role

The defined duties and authorized activities form the identity role used to decide access needs. An account represents an identity in a system, a privilege is a particular authorized capability, and an access-control matrix records access relationships.

C. Actual duties and authorized activities

A job role and a product's RBAC role need not match. Access decisions should connect actual duties, approval, fulfilment and review rather than trust a role label alone.

D. The worker's identity role

The manager is defining the duty and activity basis for access. This clarification helps align approved access with the new responsibilities.

C. Impact

The description concerns effects on business objectives if the outage occurs. Likelihood would instead address how possible or probable the event is under stated conditions.

D. Appointments and revenue could be disrupted

Disrupted appointments and revenue describe effects on objectives and therefore impact. Possibility concerns likelihood, an exploitable weakness is a vulnerability, and assessment criteria set the basis for judging risk.

A. Interpret impact within the chosen assessment context

Impact needs the relevant scenario and assessment method. A local label does not establish a universal scale or prove identical meanings across every formal vocabulary.

D. Incident

Confirmed unauthorized account takeover and record modification support an incident classification in this context. An unexplained alert alone would still need investigation against organizational criteria.

A. An observation needing investigation

An event or alert is not automatically an incident. The team needs evidence and organizational criteria before reaching the stronger classification.

B. Establish criteria and check the relevant context

The selected NIST explanation draws on a US statutory definition. It is useful context, but it does not supply a universal legal test or exact ISO definition.

A. Incident response

Incident response coordinates detecting, responding to and recovering from incidents, with preparation and continual improvement supporting that work. It is broader than one technical recovery action.

B. Coordinate detection, response and recovery responsibilities

Incident response connects detection, response and recovery, with preparation and improvement supporting the work. A backup checklist contributes to recovery but does not coordinate the other incident responsibilities. This is a practical case, not a prescribed universal phase sequence.

C. Recovery is part of wider coordinated incident work

Restoring a resource is recovery work. Incident response also coordinates detection and response, supported by wider preparation and improvement.

B. Incident response plan

An incident response plan documents responsibilities, authority and communications for handling incidents. The described arrangements concern coordinated decisions, not merely technical asset details.

C. Document decision authority and coordination

The observed gap concerns authority during response. A useful plan connects responsibilities, decision authority and communication rather than only listing people.

D. Document who communicates with whom and coordinates the messages

The observed gap is communication coordination. An incident response plan should connect relevant responsibilities, authority and communications. This targeted revision does not claim to supply a complete plan or an ISO requirement checklist.

C. Industrial control system

An ICS monitors or controls industrial processes within operational technology. Its physical operating context can make safety, reliability and performance significant constraints.

D. Safety, reliability and performance constraints

Security decisions for industrial control systems can be constrained by safe, reliable physical operations. The saved definition does not support treating them exactly like ordinary office software.

A. The packaging-line control system

The industrial-process monitoring or control role distinguishes the ICS example. Using computing software alone does not make every business application an industrial control system.

D. Information

Information is data understood in meaningful context. The description of what 27 refers to turns the value into something the team can use.

A. Its relevant context

Relevant context explains what the value refers to, its unit and its time period. More copies, faster display or a new visual format do not resolve the missing meaning.

B. Information

The content combines data with what it concerns and when it applies. That meaningful context makes it information useful for a decision.

A. Information security

Information security protects information and systems to preserve confidentiality, integrity and availability. The case deliberately includes all three rather than one objective alone.

B. Integrity and availability

Confidentiality is one objective. Information security also addresses accuracy and completeness and authorized access when needed, so encryption alone does not cover the whole concern.

C. Information security

The protection objective concerns information and relevant systems in context. It is broader than one network mechanism and includes confidentiality, integrity and availability needs.

B. Information security management system

An ISMS links organizational elements to direct and control information security. It is broader than a product, document set, department or certificate.

C. The linked management arrangements are missing

An ISMS requires connected policies, objectives, responsibilities, processes, resources and review. Purchasing technology alone does not establish those management arrangements.

D. Responsibilities, processes, resources and review

An ISMS is an operating management arrangement. Connecting the documents to accountable work and review addresses the gap beyond merely possessing a document set.

C. Infrastructure as a service

IaaS offers fundamental computing resources on which the consumer can deploy software, including operating systems and applications. The stated consumer control of operating systems distinguishes this case from the provider-supported application deployment of PaaS; using a finished provider application would illustrate SaaS.

D. The actual offering and contract

The IaaS concept identifies the type of service. Detailed responsibilities depend on the actual offering and contract, so the label alone is insufficient.

A. Infrastructure as a service

The requested arrangement provides computing resources for consumer-deployed software. The hosted finished application corresponds to the SaaS alternative instead.

D. Insider threat

Insider threat concerns potential harm connected with relevant internal access or knowledge. Considering that potential does not prove malicious intent or establish an incident.

A. Internal access-related harm need not be deliberate

The saved scope does not equate insiders with malicious people or incidents with deliberate actions. Relevant internal access or knowledge is the distinguishing context.

B. Assess potential harm without presuming malicious intent

Insider-threat analysis concerns potential harm associated with access or knowledge. It should not turn membership in an internal group into proof of malicious intent.

A. Integrity

Integrity concerns accuracy and completeness, including protection against unauthorized changes. Readable records can still lack integrity even when access remains available.

B. Integrity

Accidental loss of part of the record affects completeness, which is an integrity concern. Integrity protection is not limited to deliberate modification by attackers.

C. Integrity

The stated concern is preserving accurate, complete content. Confidentiality limits disclosure, while availability concerns authorized access when needed.

B. Intelligence cycle

The recurring direction, collection, processing, analysis and dissemination of intelligence fits the intelligence cycle. The feedback into new needs keeps it recurring.

C. Analysis and dissemination linked to needs

Collection is only part of the cycle. Intelligence work also needs direction, processing, analysis and dissemination so the material supports relevant decisions.

D. Clarify the decision-maker's intelligence need and redirect the work

Direction should connect collection, processing, analysis and dissemination to the decision need. Feedback can shape the next cycle. Phase labels vary by source; the case tests the recurring functions rather than a universal naming scheme.

C. Interested party

Interested parties can influence an activity, be affected by it or consider themselves affected. Relevance and applicable ISMS requirements still need further determination.

D. A party considering itself affected can qualify

The shared term includes parties who consider themselves affected. Identifying a party does not by itself settle relevance or which requirements apply.

A. Relevant parties and requirements still need assessment

The concept helps identify parties, but determining relevant parties and applicable ISMS requirements requires fuller teaching and context. A list alone is not completion evidence.

D. Internet of Things

IoT devices combine sensing or actuation with computing and communication functions. The connected sensor arrangement matches that combination.

A. IoT does not automatically mean industrial control

Connected devices can be IoT without serving an industrial-process control role. An embedded or connected device is not automatically an ICS.

B. The connected environment sensor

The connected environmental sensor combines all three functions. The isolated device lacks communication, the passive sensor lacks computing and communication, and the text editor alone is not the described sensing or actuation device.

A. Internet Protocol

IP provides addressing and packet delivery between networks. DNS resolves names; TCP and UDP provide transport functions rather than the IP addressing-and-delivery role.

B. An IP address is not an account or permission

IP addressing concerns network communication. Account identity and application authorization are different arrangements that cannot be inferred merely from an IP address.

A. Domain Name System naming

The stated failure concerns domain-name lookup, a DNS function. The successful address-based test is evidence about that tested IP path; it does not make name resolution the same function or prove every network path works.

B. Internet Protocol model

The named four responsibilities are the IP model's layers in this entry. OSI is the separate seven-layer model listed elsewhere.

C. A model organizes functions rather than product boxes

Models help organize responsibilities. Real products do not have to expose separate visible components for each modeled layer.

D. Internet

In this model, the internet group covers IP addressing and packet delivery. The grouping organizes functions; it does not require a separate visible product per layer. RFC 1122 provides the corresponding link, IP and transport organization, with application protocols in its companion.

C. IPv4

IPv4 uses 32-bit addresses. IPv6 uses 128-bit addresses; DNS and TCP have different roles rather than being these address versions.

D. Record IPv4 as 32-bit and keep IPv6's 128-bit fact separate

IPv4 uses 32-bit addresses; IPv6 uses 128-bit addresses. Correcting that version fact does not determine the actual configured prefix or justify old classful defaults.

A. Check the actual configured network prefix

Recognizing IPv4 does not justify assuming old classful network defaults. The actual network configuration must determine how that network is divided.

D. IPv6

IPv6 is the IP version with 128-bit addresses. IPv4 uses 32-bit addresses, while the other choices do not name these address versions.

A. IPv6 alone does not prove encryption

Using IPv6 does not automatically encrypt or secure all traffic. Address version and actual protection mechanisms must be evaluated separately.

B. The version's address length

The notes establish the relevant address-version fact. They do not demonstrate security configuration, authentication outcomes or absence of weaknesses.

A. ISC2 Certified in Cybersecurity

ISC2 CC is the selected first cybersecurity credential in this route. The route choice does not establish that a learner has completed training or met credential requirements.

B. The mapping alone establishes neither claim

A mapped syllabus or glossary supports study organization. It does not establish official course completion or demonstrate readiness for the current assessment.

C. Credential fees are separate from the free glossary

The glossary's free availability is separate from issuer credential fees and requirements. Study material availability does not establish payment, completion or an award.

B. Report the verified concern honestly through appropriate authorized channels

Honest, responsible conduct and diligent service support communicating a verified concern accurately through appropriate channels. The example applies the canon themes; it is not the complete code or an instruction to disclose restricted details publicly.

C. Raise the verified harm honestly and seek a responsible decision

Societal protection and responsible honesty support raising verified harm and seeking a responsible decision rather than giving an unsupported assurance. The high-level canons require professional judgment and do not replace the issuer's full wording.

D. Be honest about competence and service limits

Responsible honesty and competent service to principals are relevant canon themes. This example applies the paraphrased principles without claiming to quote the complete code.

C. Clauses 4–10

The saved outline places these requirements headings in clauses 4–10. Knowing that structure is orientation, rather than learning every underlying requirement.

D. The outline does not supply those details

The entry is explicitly an outline. Required records, applicability decisions and fuller Annex A teaching still require the selected course or authorized text.

A. Performance evaluation and improvement

Reviewing results fits performance evaluation, and system improvement decisions fit improvement at this introductory heading level. This indexing exercise supplies no complete requirements, prescribed review records or Annex A applicability rules.

D. ISO 9001

ISO 9001 is the quality management-system requirements standard. The other choices concern information-security requirements, control guidance or risk-management guidance.

A. Shared concepts do not replace ISO 27001 requirements

The saved ISO 9001 entry gives its role only. Shared management-system concepts do not make quality supplements a source of the complete ISO 27001 requirements.

B. Use ISO 9001 for quality and distinguish ISO/IEC 27001 for information security

ISO 9001 concerns quality-management-system requirements. ISO/IEC 27001 concerns ISMS requirements. Correctly identifying the subjects does not establish conformity to either standard or require purchasing every mentioned standard.

A. ISO/IEC 20000-1

ISO/IEC 20000-1 concerns service management-system requirements. The saved entry supplies this role, rather than a full comparison or the standard's complete text.

B. The paragraph supplies only a role overview

The saved scope is role only. It does not include full text or a complete comparison of management-system standards and their requirements.

C. Keep the service-management role distinct and assess the separate security requirements

ISO/IEC 20000-1 is a service-management-system requirements standard. Its title alone does not establish conformity with separate information-security requirements. This is a role distinction, not a full comparison of the standards.

B. The 2026 family-overview role

The saved current-edition role is the 2026 overview. The withdrawn 2018 vocabulary role must not be presented as the purpose of that current edition.

C. New publication does not automatically replace dated references

A newer edition can exist without automatically replacing a dated exam or normative reference. The relevant selected reference must still be checked.

D. Keep the overview role and use the relevant ISO/IEC 27001 requirements reference

ISO/IEC 27000:2026 explains concepts, principles and relationships; ISO/IEC 27001 specifies ISMS requirements. The supplied 2026 overview description is retained. A newer publication also does not automatically change a dated exam or normative reference.

C. ISO/IEC 27001

ISO/IEC 27001:2022 is the selected ISMS requirements standard. Control guidance and risk-management guidance have related but different roles.

D. Public overviews do not supply every requirement

The glossary identifies the requirements standard but does not contain its full base text. Public overviews cannot be treated as reconstruction of every requirement.

A. Legitimate access to the applicable requirements and relevant evidence

ISO/IEC 27001 is the requirements reference. A public overview cannot establish the exact requirement or demonstrate that it has been met. Legitimate access may be available through an appropriate course, library or other authorized source.

D. ISO/IEC 27002

ISO/IEC 27002:2022 provides control guidance. ISO/IEC 27001 is the related ISMS requirements standard, so their roles should remain distinct.

A. Control guidance does not itself confer that certificate

The saved role is control guidance, not a separate organizational ISMS requirements certificate. Reading material does not establish implementation or certification.

B. Guidance can inform design, while actual operation needs its own evidence

ISO/IEC 27002 provides control guidance. Citing guidance does not demonstrate that a local control has been implemented or works. The saved entry contains a role summary, not the full guidance or a complete effectiveness test.

A. As 2013-based implementation guidance

The saved 2017 edition explains the 2013 requirements. That historical scope must not be relabeled as assigned current 2022 implementation guidance.

B. The official course's required editions and access

Edition relevance matters: the saved discussion is 2013-based. Confirm required editions and legitimate access rather than assume the title makes it current for 2022 study.

C. Keep the 2013-based provenance and verify relevance before applying it to 2022 work

The saved ISO/IEC 27003:2017 guidance explains ISO/IEC 27001:2013. That basis must remain visible, and relevance to current 2022 work must be checked. The edition limit does not establish that every older concept is useless, nor does the glossary provide the full text.

B. ISO/IEC 27005

ISO/IEC 27005:2022 provides information-security risk-management guidance. The neighboring standards have different requirements, control or service-management roles.

C. NIST examples do not replace all ISO-specific teaching

The saved limit explicitly separates the useful NIST examples from complete ISO-specific teaching. Related concepts do not make the sources interchangeable.

D. Check legitimate access to the needed guidance

The complete risk-management guidance is not saved and access is conditional. A role summary identifies the source but does not provide its detailed contents.

C. Key control indicator

The indicator's stated purpose is understanding operation of a control. Indicator labels can vary, so the intended use provides the important context.

D. Understanding control operation

The question concerns the operation of a particular control. That fits the glossary's KCI role, rather than an unconditional prediction about future incidents.

A. What the indicator is intended to show

Indicator labels and boundaries vary across organizations. Clarifying the measure's purpose and use is more useful than assuming one universal label taxonomy.

D. Key performance indicator

A KPI tracks performance in relation to an objective. The link between the chosen result and the intended outcome is central to this use.

A. Session counts alone do not establish the intended outcome

A convenient activity count may help tracking, but it does not establish the desired business result. The indicator needs interpretation against the actual objective.

B. Task accuracy linked to the objective

Task accuracy has the stated connection to the improvement objective. The screen, directory and slide counts describe inputs or activity without demonstrating the desired task result.

A. Key risk indicator

The stated purpose is monitoring risk exposure and relevant tolerance. That is the KRI role, though no single indicator can predict every incident.

B. One indicator cannot predict every incident

A KRI helps monitor risk but does not capture every possible cause or event. A favorable reading is not a guarantee that no incident will occur.

C. The relevant exposure trend

A KRI should be relevant to risk and exposure in context. The exposure trend has that connection; unrelated counts do not gain it merely by appearing on a dashboard.

B. Label

A label is a marker communicating classification or handling expectations. Whether a product also enforces protections is a separate question.

C. A communicated handling expectation

The marker communicates a rule but need not enforce it. Actual product behavior and access configuration must be checked before claiming technical protection.

D. Check the product's actual behavior

Labels can communicate expectations without technical enforcement. The team needs evidence of the specific product's behavior to know what protection accompanies the marker.

C. Large language model

The stated characteristics fit an LLM. It is a model category, not the entire application around it or every possible generative AI model.

D. The LLM is not the whole surrounding application

The glossary defines a language-model category. The surrounding application includes additional components and arrangements that should not be collapsed into the model itself.

A. Identify the text-trained language model as the LLM and assess the other component separately

The supported LLM introduction concerns a deep-learning language model trained on very large text datasets. That does not make every generative component or the whole product an LLM. No additional model taxonomy or training rules are supplied here.

D. Leadership

Leadership provides direction and support through decisions, responsibilities and resources. The case describes enabling the management system to work rather than one technical mechanism.

A. A signature alone does not demonstrate every duty

The saved limit distinguishes a signed policy from fuller leadership support. Evidence of relevant decisions, responsibilities and resources is still needed.

B. Assign responsibilities and supporting decisions

Leadership connects direction with the responsibilities and resources that enable work. Assigning authority and support addresses the stated operational gap.

A. Least privilege

Least privilege grants only the access needed for the authorized task and context. The limited scheduling access fits the stated need.

B. Grant only the necessary narrower access

The principle ties access to what is necessary for the authorized work. Broader or unrelated authority is not justified by the stated task.

C. Remove unrelated write access

The authorized read task does not justify unrelated modification rights. Least privilege applies to the task and context, including the permissions used by automation.

B. Likelihood

Likelihood assesses how possible or probable an event or outcome is under stated conditions. Impact concerns its effects if it occurs.

C. The label is not automatically a measured probability

A descriptive likelihood label needs its method and context. It does not automatically establish a numerical probability or a universal conversion rule.

D. The failure is considered possible under current conditions

The statement that the failure is possible concerns likelihood under the stated conditions. Delayed shipments, lost orders and manual work describe potential effects rather than likelihood.

C. Logs

Logs record relevant events or activity in a system or service. Their usefulness also depends on completeness, time context, protection and availability.

D. The gaps and time context limit usefulness

Logs can support review, but their completeness and time context affect interpretation. Missing records cannot automatically establish that no activity occurred.

A. Protection and availability of the logs

Logs need suitable protection and availability as well as relevant content. Being a record of events does not automatically make them reliable or accessible when needed.

D. Machine learning

Machine learning uses data to adapt model behavior for a task, often aiming to improve performance. The aim does not itself establish a successful result.

A. Those outcomes require evaluation in context

Learning is a method and goal, not a guarantee of improvement, correctness, fairness or safe use in a new context. The new setting needs relevant evaluation.

B. The data-adapted model

The defining feature here is learning from data to adapt model behavior. A fixed instruction list does not establish that data-driven learning took place.

A. Malware

Malware is software intended to harm systems, information or users. Harmful intent distinguishes this example from an ordinary update or unintended error.

B. Failure alone does not establish malicious intent

The definition concerns software intended to harm. A crash can warrant investigation, but the stated accidental fault alone does not establish malware.

C. It can be malware because it is intended to harm information or users

Malware includes software intended to harm information or users; destruction and crashes are not required. The stated design is harmful even while the payroll system continues running. This does not supply a complete malware taxonomy.

B. Management review

Management review uses suitable evidence to make decisions about the management system, including changes, improvement and resources. It is more than receiving an unsupported status assertion.

C. Evaluate suitable system evidence and decide actions

The activity is defined by evidence-based management-system evaluation and decisions. A meeting title or schedule alone does not demonstrate that work.

D. Decide relevant resource or process changes based on the evidence

Management review evaluates suitable evidence to decide changes, improvement and resources. Decisions responding to the verified cause fit that purpose. This example does not supply the complete ISO 27001 input, output or record checklist.

C. Management system

A management system links organizational elements to set direction and objectives and operate processes to achieve them. It is broader than one artifact or device.

D. Connect the objective to operating processes and responsibilities

The concept concerns linked organizational elements used to achieve objectives. Connections to actual work and responsibility address the stated gap.

A. Shared concepts do not replace ISO 27001 requirements

Management systems share useful concepts, but that does not make ISO 9001 supplements the ISO 27001 requirements. Source roles and teaching limits remain distinct.

D. Central policy prevents subjects from changing permissions at their discretion

The relevant distinction is mandatory enforcement restricting subjects' discretion. Central administration alone is not a unique identifier of one model; role or attribute mechanisms may also be involved in an actual system.

A. Mandatory access control

The second service restricts subjects' permission discretion through centrally defined policy. The first illustrates the contrasting discretionary concept.

B. The creator cannot bypass the mandatory policy through discretionary sharing

Mandatory access control restricts the subject's discretion over permissions. Creating or owning the file does not by itself authorize overriding the governing policy. MAC is used here in its access-control meaning.

A. Maximum tolerable downtime

MTD is the total business interruption that can be tolerated for the activity. A resource recovery target is a related but distinct concept.

B. Maximum tolerable downtime

The business tolerance describes MTD. RTO concerns a target time for restoring a resource or service, while RPO concerns a recoverable data point.

C. The actual activity and business context

MTD is a context-dependent business limit. A value must reflect the activity under consideration rather than an arbitrary or borrowed universal number.

B. Measure

In the selected NIST usage, a measure is an objective, quantifiable value obtained through measurement. Measurement names the process that produces the value.

C. The recorded 54-minute value

The value obtained is the measure in the selected NIST terminology. The process of determining that value is measurement.

D. Collection method, scope and units

A quantitative value needs method, scope and units for interpretation. The selected usage does not make an unexplained number self-interpreting or universally comparable.

C. Measured service

Measured service concerns metering and reporting resource use. Expanding capacity, accessing over networks and provisioning through self-service describe other cloud characteristics.

D. Usage metering does not prove security effectiveness

Measured service describes resource-use metering. A security-effectiveness judgment requires relevant evidence about intended security results, not merely consumption figures.

A. Appropriate resource-use metering and reporting

The distinguishing characteristic is monitored, controlled and reported resource use through appropriate metering. The other features relate to different cloud characteristics.

D. Measurement

Measurement is the process for determining a value. Judging the resulting value against criteria would be evaluation rather than measurement alone.

A. Determining the duration

Measurement names determining the value. The result is a value, while comparing it with a target adds evaluation.

B. Determining a value alone proves neither claim

Measurement needs a stated vocabulary and context. Determining a value does not itself establish control effectiveness or fulfil the complete performance-evaluation requirements.

A. Media sanitization

Media sanitization addresses infeasible access to target data on storage media at the chosen effort level. Method selection depends on the medium, information and obligations.

B. Choose and verify a suitable method for the context

The saved definition does not supply a universal delete-based solution. Suitable method choice depends on the medium, information and applicable obligations.

C. Select a suitable method for each medium, information and applicable obligations

Sanitization aims to make access to target data infeasible at the chosen effort level. Method choice depends on the medium, information and obligations. The definition does not supply a universal delete-based solution or prescribe a real-device procedure.

B. Metric

In this NIST usage, a metric is a measure or assessment result designed to track progress, support decisions and improve performance. Its purposeful use matters.

C. Coverage does not equal an overall security percentage

The coverage result addresses a defined configuration scope. A metric can inform decisions without establishing a percentage of total security or capturing every relevant risk.

D. The selected terminology and intended decision use

The saved distinction is specific to NIST SP 800-55v1. Naming the vocabulary and explaining decision use avoids implying a universal rule across sources.

C. Microsegmentation

Microsegmentation applies fine-grained separation and policy enforcement between workloads or resources. The emphasis here is the granularity of enforced communication boundaries.

D. Actual policy enforcement

Separation requires actual enforcement and appropriate rules. A drawing alone does not demonstrate that communication between workloads is controlled.

A. Microsegmentation

The need is fine-grained separation and enforcement between workloads. Broad segmentation supplies a wider boundary but does not by itself describe that finer control.

D. MITRE ATT&CK

ATT&CK organizes observed adversary behavior through tactics, techniques and related information. Its mappings can support reasoning but do not prove detection or attribution.

A. A mapping proves neither claim by itself

ATT&CK mapping describes behavioral relationships. It does not alone establish actor identity, detection success or complete coverage of relevant adversary behavior.

B. Gather evidence that the relevant detections actually work

ATT&CK mappings organize behavior; they do not demonstrate detection success. The team needs evidence about its actual detections for the relevant behavior, and even successful tests do not prove complete coverage of all adversary activity.

A. Mock exam

A mock exam is a practice assessment resembling aspects of an exam. It does not itself award a credential or establish completion of the official route.

B. That complete verified mock is not saved

The saved scope explicitly lacks a complete fresh current CC or PECB mock with a verified key and explanations. A label cannot fill that evidence gap.

C. Treat an extra bank purchase as conditional

Extra-bank payment is conditional, not automatic. A mock can support practice without becoming an invented formal credential requirement or proof of readiness.

B. Model poisoning

In the selected scope, model poisoning directly manipulates the model or its updates during training. Manipulating training data is the contrasting data-poisoning concept.

C. Data checks alone do not cover every poisoning path

The selected model-poisoning definition includes direct model or update manipulation. Data-integrity checks do not by themselves address every such path.

D. Behavior change alone does not establish adversarial model manipulation

The selected term requires direct adversarial manipulation of a model or its updates during training. A changed result alone does not establish that cause. The case does not prove either a poisoning attack or a different failure category.

C. Monitoring

Monitoring determines the status of a system, process or activity. Security monitoring is a more specific use, while this case concerns a general service activity.

D. Monitoring

The described work determines current status. Evaluation would add a judgment against criteria or objectives, which the case says has not yet occurred.

A. Observed recent run status and current pending work

Monitoring determines the status of a system, process or activity. Current observations about runs and pending work address that need; ownership and a planned schedule alone do not establish current status.

D. Multifactor authentication

MFA uses more than one distinct factor type. The password and held device represent different types; multiple steps are not sufficient if they use only one type.

A. Both can be knowledge-based evidence

Two knowledge-based secrets do not establish distinct factor types. MFA requires more than one type, not merely multiple prompts.

B. Not all MFA is phishing-resistant

MFA identifies use of distinct factor types. Phishing resistance is a further protocol property that cannot be inferred from the MFA label alone.

A. Network

The connected computers and service can exchange information and therefore form a network. An inventory, an isolated device or a locally retained file alone does not establish connections between systems.

B. The connected record-exchanging systems

The ability of connected systems to exchange information is the defining feature here. Merely listing equipment does not establish such connectivity.

C. Connections enabling the systems to exchange information

A network comprises connected systems that can exchange information. Installing the same application or listing devices does not by itself provide those connections. The case identifies the missing basic capability, not a full network design or diagnosis.

B. Network segmentation

Network segmentation divides networks or resources into zones with controlled communications. The control of paths between zones matters as much as their names.

C. A diagram alone does not establish isolation

Segmentation needs actual controlled communication paths. A diagram describes an intention but cannot by itself establish that the intended separation is enforced.

D. Network segmentation

The work defines zones and controls communication between them. Verification helps distinguish operational separation from a diagram-only claim.

C. Nonconformity

A nonconformity is failure to meet a requirement. The case connects the applicable requirement, verified evidence and specific failure needed for a defensible finding.

D. Applicable requirement and verified failure evidence

A vulnerability is not automatically a nonconformity. A defensible finding must connect a requirement to verified evidence of a specific failure.

A. Export E-17 occurred without the approval required by the applicable contract

The statement links the identified requirement, verified evidence and specific failure. A hypothetical threat does not establish a nonconformity, and the basic definition does not assign a universal finding severity.

D. Non-human identity

A non-human identity represents software, automation or a service. Its ownership and permissions still need to be governed rather than assumed from the automation label.

A. Service authentication mechanisms vary

The saved scope distinguishes service identity arrangements from prescribing one human MFA mechanism for every unattended service. Ownership and authentication still need suitable design.

B. Ownership and approved permissions

A service identity represents software rather than a person, but still needs accountable ownership and appropriate permissions. Its automated nature does not justify unmanaged access.

A. Non-repudiation

Non-repudiation concerns evidence countering a later denial of action or origin. Signature evidence can help, but its identity binding and protection context remain important.

B. Evidence context matters and no legal outcome is guaranteed

The saved scope does not promise unconditional legal outcomes. Identity binding, key protection and the evidence context affect what the evidence can support.

C. The evidence needs identity-binding and key-control context before individual attribution

Signature evidence can help counter denial, but the connection between a key and a person matters. Shared or poorly controlled keys limit individual attribution. The evidence does not promise an unconditional legal outcome.

B. Objective

An objective is a result to be achieved, connected to organizational needs and a way to evaluate progress. The described result has those links.

C. Improve a defined task outcome and evaluate progress

An objective should identify the desired result and its organizational relevance. Counting activity alone does not specify the outcome the organization wants to achieve.

D. Define the relevant access-removal result and how progress will be evaluated

An objective identifies a result to be achieved, relates it to organizational needs and provides a way to evaluate progress. The new need calls for a relevant result rather than an unrelated output count. Exact ISO objective-planning requirements are beyond this example.

C. Objective evidence

Objective evidence supports a matter's existence or truth through relevant facts or verification. Here, the checked record supports a specific permissions claim.

D. Relevant verified access evidence

Plausible AI output or unsupported opinion is not automatically objective evidence. The assessor needs relevant facts or verification for the actual permissions claim.

A. Obtain relevant evidence for the current system and period

Objective evidence must support the particular matter being assessed. The old export may establish a historical state, but it does not by itself verify current permissions in a different system after migration.

D. On-demand self-service

On-demand self-service lets the consumer provision needed capabilities without routine human interaction with the provider. Authorization and governance still apply.

A. Self-service still needs authorization and governance

The characteristic concerns how capabilities are provisioned. It does not remove the need for appropriate authorization or governance of their use.

B. Provisioning without routine provider-human interaction

The distinguishing feature is consumer provisioning without routine human interaction with the provider. Metering, pooling and network access describe different characteristics.

A. Operating system

An operating system manages computer resources and provides services for applications. The application performs the user's scheduling task using those supporting services.

B. The operating system

The operating system manages computer resources and supplies services to applications, including file services. Identifying that role does not by itself prove whether the ultimate cause lies in configuration, software, hardware or another dependency.

C. The resource-management software remains distinct from the scheduling application

The operating system is identified by managing resources and providing services for applications. The scheduling application uses those services for its business task; visibility to staff does not change that role distinction.

B. Operation

Operation concerns performing and controlling planned processes as recurring work. Designing or documenting the process alone does not show it operates.

C. Perform and control the planned reviews

Executing the planned review process and retaining suitable evidence addresses operation. A document or future intention alone does not demonstrate recurring work.

D. The planned change process has been performed

The records can support that planned work occurred. That is relevant to operation, but it does not automatically establish full conformity, perfect reliability or certification.

C. Operational technology

OT consists of programmable systems or devices interacting with or managing physical processes. Physical consequences matter alongside information concerns.

D. Physical consequences of system behavior

The saved OT scope emphasizes physical consequences as well as information confidentiality. A physical-process interaction changes what relevant harm can involve.

A. Its actual interaction with and management of the physical process

The saved OT concept turns on programmable systems or devices interacting with or managing physical processes. The current function matters; a previous label does not remove the new physical consequences. This does not prescribe a complete OT security assessment.

D. Organizational context

Organizational context concerns internal and external conditions relevant to objectives and the management system. These conditions help inform later boundary and management decisions.

A. Relevant internal and external conditions

A context discussion should address relevant conditions around the organization and its objectives. One preferred product does not supply that broader basis.

B. Examine the changed internal and external conditions relevant to objectives and the management system

Organizational context concerns relevant internal and external conditions. Changes in markets and dependencies warrant examining their relevance to the objectives and management system. This example does not provide the complete ISO context or amendment requirements.

A. OSI model

The seven named layers identify OSI. The IP model in the glossary instead groups responsibilities as link, internet, transport and application.

B. Compare the named responsibilities while preserving each model's structure

OSI has seven named layers, while the selected IP model has four groups. The models aid reasoning, but their numbering and structures are not interchangeable. No excluded archived OSI lesson is reinstated by making that comparison.

C. Organizing networking functions for discussion

The saved definition supports using the model as an aid to reasoning. Layer names alone do not establish behavior, security or the contents of excluded material.

B. Packet

A packet is an individual carried unit with protocol context and payload. An entire conversation can contain many packets; an endpoint identifier or network name alone is not such a unit.

C. Packets are not all the same size

The saved limit explicitly rejects one universal packet size. A larger application exchange can also be carried through multiple packets.

D. One application exchange can be carried in multiple packets

A packet is a unit carried through the network, not necessarily an entire application conversation. Multiple packets can support one exchange, and packet sizes can vary.

C. Password

A password is a secret knowledge-based authentication value. An account name or address is not the same evidence, and authorization concerns permitted actions.

D. Password

A password is knowledge-based evidence. The other factor examples concern possession and inherence; a public username alone is an identity claim rather than a secret password.

A. Keep the guidance's scope and check applicable requirements

The saved NIST password rules have a defined scope. They must not be presented as universal EU law or one automatically applicable rule for every system.

D. Patch

A patch is an update intended to correct or change software, including weaknesses. Broader deployment and verification work belongs to patch management.

A. Downloading alone does not prove remediation

The patch's existence or download does not establish effective correction on affected systems. Deployment and verification evidence are still needed.

B. The update was installed but effectiveness needs verification

Even installation alone does not prove effective remediation. The result must be checked in the affected context rather than inferred solely from the update action.

A. Patch management

Patch management coordinates the wider update process, including planning, preparation, deployment, verification and monitoring. It is broader than the existence of one update.

B. Manage assets, deployment and verification together

The gap concerns coordinated update management. Identifying affected assets and following through deployment and verification is necessary beyond simply collecting update files.

C. The actual affected assets and context within coordinated deployment and verification

Patch management coordinates affected-asset identification, planning, preparation, deployment, verification and monitoring. Illustrative examples do not supply a universal deadline; the plan must reflect the actual assets and context.

B. PECB ISO/IEC 27001:2022 Foundation

The selected second route leads to the PECB Certificate Holder in ISO/IEC 27001:2022 Foundation award under its requirements. It is distinct from the other listed routes.

C. Foundation does not confer those distinct statuses

The saved scope distinguishes Foundation from Lead Auditor, Lead Implementer, organizational certification and professional licensing. Those statuses cannot be inferred from the Foundation title.

D. The selected official route remains to be completed

The selected paid course and activities are not obtained or completed in the saved scope. Free notes do not establish their completion or the award.

C. High-level general, high-level specific, topic-specific

The verified labels are high-level general, high-level specific and topic-specific. The saved handbook does not teach their exact boundaries, definitions or example classifications.

D. Learn the provider's boundaries before classifying

Only the category names are verified here. Exact classification needs the selected PECB teaching; a different source's taxonomy cannot be assumed to substitute precisely.

A. The names with an explicit definitions gap

The evidence supports recognition of the names and acknowledgment of the gap. Exact definitions, boundaries and examples remain to be learned from the selected paid course.

D. Penetration test

A penetration test examines exploitable paths within authorized agreed scope. The authorization and boundaries are part of the described activity, not optional assumptions.