Question 840
The change advisory board sees a repeat risk in this case: A campus controller account uses full administrative privileges for a service that only reads interface statistics. Which preventive design control MOST DIRECTLY addresses this specific risk?
Explanation
Correct Answer
Rotate API secrets and review service account privileges regularly. This control targets the underlying design risk. Model-driven management interfaces can modify sensitive configuration if clients are overprivileged. The follow-up acceptance check remains: Read operations succeed while unauthorized configuration attempts are denied and audited.
Incorrect Answers
RESTCONF presents model-defined data using HTTP-based resources, unlike NETCONF’s RPC-oriented protocol session. The repeat risk here is different: Model-driven management interfaces can modify sensitive configuration if clients are overprivileged. A directly relevant preventive control is: Rotate API secrets and review service account privileges regularly.
NETCONF uses structured RPC operations and can support explicit configuration datastores and commit controls. The repeat risk here is different: Model-driven management interfaces can modify sensitive configuration if clients are overprivileged. A directly relevant preventive control is: Rotate API secrets and review service account privileges regularly.
IaaS provides compute, storage and network building blocks while the customer typically manages the guest OS and workloads. The repeat risk here is different: Model-driven management interfaces can modify sensitive configuration if clients are overprivileged. A directly relevant preventive control is: Rotate API secrets and review service account privileges regularly.