Pass ISC CISSP Exam in First Attempt Guaranteed!

This is an advantage of another design (Use a formal retirement checklist covering identity removal, archives, licenses and data disposition.), not the particular flaw of Permanently delete all historical records as soon as the replacement goes live.

This is a limitation elsewhere: A team removes obsolete virtual machines but loses the records documenting license ownership and privileged accounts. It does not explain the deficiency of the specified proposed approach.

This explains a later shift in requirements (The seven-year period ends without legal holds.), not the failure of the current proposal.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is A test query retrieves an authorized archived record with verified integrity and access logs.

This demonstrates controls in another circumstance: A medical device uses an operating system that has reached end of support but is still needed for a critical procedure.

This other observation is relevant to: A team removes obsolete virtual machines but loses the records documenting license ownership and privileged accounts.

This is a record of how the initial safeguard would be checked, not an action implementing the newly requested condition: A test query retrieves an authorized archived record with verified integrity and access logs.

This is the appropriate response to the original situation: System retirement must not destroy legally required information or leave it inaccessible. It does not directly meet the new condition.

This remains inappropriate: Premature deletion may breach retention obligations and impair dispute resolution.

Dormant credentials create unnecessary exploitable access paths. The proposal would not be defensible for this case.

This is appropriate for a later condition (An auditor requests evidence of the former system's approved disposition.), but it does not directly resolve the initial need. Demonstrable audit history remains necessary after the asset itself is retired.

This response addresses a different condition: An organization is replacing payroll software but regulations require seven years of historical pay records. The present case requires the measure described by Use a formal retirement checklist covering identity removal, archives, licenses and data disposition.

This is a limitation elsewhere: A medical device uses an operating system that has reached end of support but is still needed for a critical procedure. It does not explain the deficiency of the specified proposed approach.

This explains a later shift in requirements (An auditor requests evidence of the former system's approved disposition.), not the failure of the current proposal.

This is an advantage of another design (Assess exposure and implement isolation, compensating controls and a time-bound replacement plan.), not the particular flaw of Leave service account keys active in case the retired server is needed again.

At-rest encryption does not enforce permitted data movement or approved destinations. The rejected action is: Assume endpoint full-disk encryption prevents every outbound cloud upload.

This is useful evidence after implementation, rather than the FIRST recommended decision for this objective. A controlled exfiltration test is blocked and logged for the relevant classification and user context.

This addresses a distinct subsequent requirement: A different risk review finds that stolen powered-off laptops expose unencrypted local caches. The new loss scenario concerns data at rest on devices, not cloud egress behavior.

Approval alone cannot fix the specific weakness: At-rest encryption does not enforce permitted data movement or approved destinations.

The subsequent circumstance is separate and does not explain why this proposed action fails the initial case. The new loss scenario concerns data at rest on devices, not cloud egress behavior.

Destroying records would weaken oversight and cannot remedy the immediate technical or governance flaw: At-rest encryption does not enforce permitted data movement or approved destinations.

An unexecuted future plan does not prove current effectiveness for the stated 2.6 objective. The evidence should include: A controlled exfiltration test is blocked and logged for the relevant classification and user context.

Absence of reported incidents is not a controlled validation of the requirement. A stronger proof is: A controlled exfiltration test is blocked and logged for the relevant classification and user context.

Discussion of a different design does not demonstrate the deployed control. The new loss scenario concerns data at rest on devices, not cloud egress behavior.

This addresses the original situation: Disk encryption protects stored bytes, not voluntary or accidental release to unapproved cloud services. It does not directly meet the changed requirement: A different risk review finds that stolen powered-off laptops expose unencrypted local caches.

The earlier rejected approach remains inappropriate. At-rest encryption does not enforce permitted data movement or approved destinations.

The new requirement needs an accountable response, not automatic deferral. The new loss scenario concerns data at rest on devices, not cloud egress behavior.

This response addresses a different condition: A video rights company shares pre-release screeners with distribution partners and needs traceable authorized use. The present case requires the measure described by Enforce least-privilege export rights, monitored egress and approved endpoint handling.

The system can release plaintext through application functions after decryption. The proposal would not be defensible for this case.

This is appropriate for a later condition (A stolen powered-off backup drive contains sensitive records outside the database.), but it does not directly resolve the initial need. The new risk concerns storage of offline copies rather than live export privileges.

This is an advantage of another design (Use integrated CASB or SSE controls and classification-aware data loss policies across cloud flows.), not the particular flaw of Conclude stored-data encryption alone blocks every data loss path.

This is a limitation elsewhere: An enterprise needs to monitor classified documents moving from sanctioned SaaS to unsanctioned services. It does not explain the deficiency of the specified proposed approach.

This explains a later shift in requirements (A stolen powered-off backup drive contains sensitive records outside the database.), not the failure of the current proposal.