Q1.Protective DNS blocked eleven thousand queries a day for six months and now blocks a few hundred, with no change to the threat feed and no reduction in user population or internet traffic volume. Endpoint telemetry shows browsers resolving names successfully. What is happening, and which combination of changes restores the control?

• A.Clients are resolving through browser based encrypted DNS, so policy manage it on managed devices and block known public encrypted DNS endpoints at egress while permitting your own encrypted resolver
• B.Clients are resolving through browser based encrypted DNS, so block all outbound traffic on ports 53 and 853 except to the internal resolvers
• C.The resolver cache is now warm enough that most queries never reach the policy engine, so shorten cache lifetimes on the protective resolver
• D.The threat feed provider has consolidated its indicators, so add a second feed and lower the confidence threshold for blocking

Domain: Security Engineering

Q2.A payments service and a checkout service run in a container platform and currently authenticate to each other with a shared secret held in a configuration file, refreshed manually each year. You want mutual authentication that survives the workload being rescheduled onto any node. What should the design use?

• A.Issue each workload a certificate bound to the node it runs on, and re-issue on reschedule
• B.Issue each workload a platform-attested identity with a short-lived, automatically rotated credential naming the workload rather than its host
• C.Move the shared secret into a managed secrets store and rotate it automatically every thirty days
• D.Accept connections based on the source address range assigned to the platform's node pool

Domain: Security Architecture

Q3.A security architect has no mandate over a product engineering group that reports elsewhere, and needs the group to start signing container images. The group has two open headcount and a launch in six weeks. What approach is most likely to succeed?

• A.Send the signing standard with a compliance deadline and copy the group's director.
• B.Arrive with the four-line pipeline change already tested against a copy of the group's build, and ask only for that.
• C.Escalate to the executive sponsor and request a mandate covering all product engineering groups.
• D.Add the group's non-compliance to the risk register and review it at the next steering committee.

Domain: Governance, Risk, and Compliance

Q4.Four teams issue certificates through different routes: one uses a public authority's console, one uses a cloud certificate manager, one uses an internal authority, and one buys certificates on a corporate card. A five-hour outage was caused by an expired certificate nobody owned. The board asks for a solution. Which first step actually addresses the failure?

• A.Stand up a new consolidated internal certificate authority and migrate all issuance to it
• B.Configure expiry alerting at thirty days on every certificate currently in the monitoring platform
• C.Run active discovery across scans, platform APIs and transparency logs into one register with an owner named per certificate
• D.Extend validity periods to three years so renewals occur less frequently

Domain: Security Architecture

Q5.A Statement of Applicability being prepared for a first certification audit marks every Annex A control as applicable and implemented, including several the organization plainly does not perform, such as controls for development environments it does not operate. The consultant says a full sheet looks stronger to an auditor. What is the correct approach?

• A.Mark every control applicable as advised, since claiming more coverage cannot be penalised at audit.
• B.Record honest applicability decisions, including controls deliberately excluded, each with a stated justification.
• C.Delete the rows for controls the organization does not perform so the sheet contains only live controls.
• D.Mark the questionable controls as applicable but not yet implemented, with no target date, so the sheet stays complete.

Domain: Governance, Risk, and Compliance