Evidence cards
Attempt each case before opening the solutions. All case facts are fictional teaching inputs.
Case 1 · One sign-in, two different factors
- A learner signs in with a password and a code from a separately held authenticator device. The code demonstrates possession of that device.
- After this sign-in, the learner opens the lab portal and document library without signing in again.
Which two concepts describe these separate features?
- SSO for the factors; MFA for session reuse
- MFA for the factors; SSO for session reuse
- OTP proves MFA, regardless of the password
- Two applications prove two-factor authentication
Case 2 · Calendar access without sharing a password
- A user approves a scheduling tool to read calendar entries through a scoped access token.
- The tool does not receive the calendar password. This question is about delegated API authorization, not proving the user’s identity.
Which framework best matches the required authorization?
- SAML
- TLS
- PKI
- OAuth
Case 3 · A root-cause classification
- An analyst has a vendor advisory for a particular vulnerability and a severity score.
- The analyst now wants a standardized classification for the underlying weakness type, such as an input-validation weakness.
Which reference answers this specific question?
- CWE
- CVE
- CVSS
- NVD
Case 4 · An alert becomes a repeatable workflow
- Identity and application events are already collected and correlated.
- The team needs a repeatable workflow that enriches each qualifying alert, creates a ticket, and requests analyst approval before isolation.
Which capability most directly supplies the missing workflow?
- SIEM
- SOC
- SOAR
- EDR
Case 5 · Service returns, but how much data is missing?
- An application stops at 14:00. The tested recovery restores service at 14:45 with data current through 13:50.
- The agreed RTO is 60 minutes; the RPO permits a data-loss window of no more than 5 minutes. Use these scenario definitions.
Which conclusion follows from the measured gaps?
- Both objectives were met
- RTO was met; RPO was missed
- RPO was met; RTO was missed
- Both objectives were missed
Case 6 · A status response for one certificate
- A client needs a signed response about an individual certificate’s revocation status.
- It is not requesting a new certificate and does not want to download a complete revocation list.
Which mechanism matches the request?
- CSR
- CRL
- PKI
- OCSP
Case 7 · Authentication must match the visible From domain
- A receiving mail system has checked SPF and DKIM.
- The next decision requires an authenticated SPF or DKIM identity to align with the message’s visible From domain, while considering that domain’s published handling preference.
Which mechanism combines these checks?
- DMARC
- SPF alone
- DKIM alone
- BIMI
Case 8 · Alerting is not the requested stopping action
- A network control sits inline and is configured to identify and drop traffic that matches a defined attack signature.
- The requirement is automatic prevention at this point, not just an alert or a cloud-configuration review.
Which acronym most directly describes this capability?
- IDS
- CSPM
- IPS
- DLP