MICROSOFT
SC-401: Make Sensitivity Labels Enforceable
Two employees open the same document. One sees a Confidential banner and can forward an unrestricted copy; the other receives…
EXAMTOPICS EDITORIAL
Author: admin
MICROSOFT
SC-401: DLP and Retention Solve Different Problems
An employee accidentally attaches a payroll spreadsheet to a message addressed to a supplier. A DLP rule may warn or…
MICROSOFT
SC-401: Insider Risk Without Unfair Assumptions
A project manager downloads a large set of documents late on Friday. A monitoring system marks the event as unusual.…
MICROSOFT
SC-401: Investigate Alerts Without Losing the Evidence
A data loss prevention policy reports that a protected file was shared outside the organization. A manager says the recipient…
AMAZON
AWS SCS-C03: Cloud Security Decisions That Matter
A security design can pass a checklist and still fail the business. Imagine an AWS application with encrypted databases, strict…
AMAZON
AWS SCS-C03: Identity and Access Without Excess Privilege
A production incident begins with an oddly narrow report: a monitoring function is allowed to read metrics but can also…
AMAZON
AWS SCS-C03: Network Security Across VPC Boundaries
The architecture diagram says the application is private. Its instances run in private subnets, the database has no internet-facing endpoint,…
AMAZON
AWS SCS-C03: Encryption and Data Protection by Design
A team encrypted its S3 bucket and closed a security ticket. Months later, a compromised workload role copied confidential objects…
AMAZON
AWS SCS-C03: Threat Detection, Logging and Response
At 02:17, a workload role begins calling an API it never used before. One monitoring tool reports unusual behavior. A…
ISC2
CISSP Security and Risk Management: Decisions Before Controls
An organization can purchase a powerful security product without knowing which business risk it is meant to reduce. It can…
ISC2
CISSP Security Architecture: Engineering for Failure
An organization moves sensitive workloads into a new cloud platform and announces that the project meets its security objectives. The…
ISC2
CISSP: Identity, Access and Secure Communication
The employee’s account was disabled at 17:00, yet a contractor platform still accepts a valid session at 18:30. A network…
ISC2
CISSP: Testing Security Controls and Running Operations
A vulnerability scan reports a high-risk finding on a production server. The operations team says the patch was applied, the…
ISC2
CISSP: Asset Protection and Secure Software Delivery
A company purchases a customer-service platform, uploads sensitive historical records, and begins using its new analytics features. Its security team…
MICROSOFT
MD-102: The Endpoint Administrator’s Decision Map
A company can enroll a thousand laptops in Microsoft Intune and still have an endpoint-management problem. Devices arrive on time,…