Security Policies and Procedures practice questions

Disconnect the server from the network immediately to contain the threat.

Why it fails: Containment occurs after initial triage and prioritization.

Escalate the incident to Tier 3 for advanced malware analysis.

Why it fails: Escalation happens after triage if needed.

Notify legal counsel and PR to prepare for potential data breach.

Why it fails: Notification occurs after the incident is confirmed and prioritized.

Monitor

Why it fails: Monitoring is not a treatment option; it is part of risk management.

Ignore

Why it fails: Ignoring is not a formal treatment option.

ISO 27001

Why it fails: ISO 27001 is a security management standard, not threat intelligence sharing.

OpenIOC

Why it fails: OpenIOC is a format for indicators of compromise, but not a primary standard in the curriculum.

MISP

Why it fails: MISP is a platform, not a standard or protocol.

SOC Tier 1 analyst

Why it fails: Tier 1 may detect but not lead insider threat response.

PR

Why it fails: PR is for external communication, not directly involved in insider threat response.

External auditor

Why it fails: External auditors are not typically part of the response team.

Connect the drive directly to the forensic workstation

Why it fails: Connecting directly risks accidental writes; a write blocker is necessary.

Install antivirus software on the drive

Why it fails: Installing antivirus on the drive writes files and modifies metadata, destroying the evidential integrity the analyst must preserve. Write blockers and hashing are used instead. Antivirus installation belongs on a live workstation being hardened, not on media awaiting forensic imaging, where any write invalidates the copy's admissibility.

Public Relations

Why it fails: Public Relations manages external messaging, which is irrelevant while an insider threat is still being investigated. PR is tempting because reputational damage can follow a breach disclosure, and would be correct only after containment, when a public statement or media response is required.

CISO

Why it fails: The CISO owns security strategy and risk appetite, not the conduct of a specific insider investigation. Consulting them is tempting because insider threats are security governance matters, and would be correct when the question concerns policy, escalation or organisational risk acceptance rather than case handling.

Legal counsel

Why it fails: Legal counsel advises on employment law, evidence handling and prosecution, but the analyst needs investigative guidance on the incident itself. Legal is tempting because insider cases often end in disciplinary or criminal action, and would be correct once evidence must be preserved or charges considered.

Transfer

Why it fails: Transfer (e.g., insurance) may not fully address the vulnerability.

Accept

Why it fails: Acceptance is for low likelihood and low impact, or when cost of mitigation exceeds risk.

Avoid

Why it fails: Avoiding means discontinuing the activity, which is not necessary here.

Legal counsel

Why it fails: Legal counsel handles legal obligations, not business impact.

Incident handler

Why it fails: Incident handlers investigate and respond, not make business decisions.

HR

Why it fails: HR handles insider threat cases, not general business impact.

SIEM

Why it fails: SIEM is a security information and event management system, not a sharing standard.

OpenIOC

Why it fails: OpenIOC is a format but not a sharing platform/protocol; though used, less comprehensive than STIX/TAXII.

Lessons learned analysis

Why it fails: This occurs in Post-Incident Activity.

Initial triage

Why it fails: Initial triage is part of Detection and Analysis.

Identifying the incident

Why it fails: Identification is part of Detection and Analysis.

Authentication

Why it fails: Authentication verifies the identity of a user or system. It is a critical security mechanism but not one of the three CIA triad goals. Authentication supports access control and confidentiality but is not a primary goal itself.

Availability

Why it fails: Availability is indeed part of the CIA triad, but the question asks for TWO goals. Since the triad includes three components, selecting Availability would be incorrect if only two are allowed. However, in this scenario, the correct selections are Confidentiality and Integrity, making Availability a distractor.

Non-repudiation

Why it fails: Non-repudiation ensures that a party cannot deny having performed an action, often achieved through digital signatures. While important for security, it is not one of the three primary goals of the CIA triad. It is a separate concept that supports accountability.

Recovery Point Objective (RPO)

Why it fails: RPO defines the maximum acceptable amount of data loss measured in time. It determines how far back in time data must be recovered. In this scenario, the manager needs to define the maximum acceptable downtime, not data loss. Therefore, RPO is not the correct metric for the time limit of unavailability.

Maximum Tolerable Downtime (MTD)

Why it fails: MTD is the total time a business can tolerate a disruption before it suffers unacceptable consequences. While related, MTD is broader and often includes RTO and RPO considerations. The question specifically asks for the maximum acceptable time a function can be unavailable, which is precisely RTO. MTD is the overall limit, not the specific recovery time objective.

Annualized Loss Expectancy (ALE)

Why it fails: ALE is a financial metric that estimates the expected annual loss from a risk. It is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). ALE does not define a time limit for unavailability; it quantifies potential financial impact. Therefore, it is not the correct metric for this scenario.

SOC Manager

Why it fails: The SOC Manager oversees the security operations center staff and processes, including incident escalation and resource allocation, but is not the designated role for media and customer communications. Their focus is on operational management and ensuring the SOC functions effectively. They may be involved in internal communications, but not as the primary public relations contact.

Legal Advisor

Why it fails: The Legal Advisor provides guidance on legal obligations, regulatory reporting, and evidence handling, but does not typically handle media inquiries or customer communications directly. They may review statements, but the coordination and delivery of communications to the public and customers falls to the communications role. The Legal Advisor is not the primary point for media relations.

Incident Handler

Why it fails: The Incident Handler is focused on the technical investigation, containment, eradication, and recovery of the incident. While they may provide technical details to communications, they are not responsible for media inquiries or customer communications. Assigning them this duty would distract from their primary technical response tasks and is not the designated role for public-facing communication.

Installed software list from the registry.

Why it fails: The registry is stored on disk and survives a reboot. Installed software information is non-volatile and can be collected at any time. It does not need to be captured before shutdown. This option is incorrect because it describes persistent data, not volatile data. The question specifically asks for data lost when the system is powered down.

Files in the Recycle Bin on the desktop.

Why it fails: Files in the Recycle Bin are stored on the hard drive and persist after shutdown. They are not volatile and can be recovered later. While they may contain useful evidence, they are not lost when the system powers down. The question focuses on volatile data, so this option does not meet the criteria. It is a distractor based on common evidence locations.

System event logs stored on the local hard drive.

Why it fails: Event logs are stored on persistent media and survive a shutdown. While they are important, they are not lost when the system powers off. They can be collected after volatile data. The question asks for data lost on shutdown, so event logs do not qualify. They are part of non-volatile evidence and can be gathered later without loss.

Post-Incident Activity

Why it fails: Post-Incident Activity covers reviewing lessons learned and improving defences after an incident closes, not authoring or exercising the plan itself. It is tempting because plan updates often follow a post-mortem, but NIST SP 800-61 Rev 2 places plan development and exercising in Preparation.

Detection and Analysis

Why it fails: Detection and Analysis identifies and scopes incidents using the plan's procedures and contacts. It is tempting because the plan is consulted here, but NIST SP 800-61 Rev 2 places developing and exercising the plan in Preparation, which precedes detection and equips the team beforehand.

Containment, Eradication, and Recovery

Why it fails: Containment, Eradication, and Recovery executes the plan against a live incident, limiting damage and restoring systems. It is tempting because responders follow documented procedures here, but NIST SP 800-61 Rev 2 assigns developing and exercising the plan to Preparation, before any incident occurs.

Initiate the legal hold process to preserve evidence

Why it fails: A legal hold preserves data for litigation and is invoked by legal counsel, not as an initial containment step. It is tempting because evidence preservation matters in incidents, but the analyst must first contain the threat, for example by disabling the targeted account or blocking the source IP, before any evidentiary procedures.

Contain the threat by blocking the IP address on the firewall

Why it fails: Blocking the source IP is a containment step, which follows detection and analysis in the incident response lifecycle; the stem asks for the first action, so scoping and validating the alert must precede any firewall change. Blocking suits confirmed active attacks, not unverified SIEM alerts.

Escalate the alert to Tier 2 for deeper investigation

Why it fails: Escalation transfers ownership but skips the analyst's initial triage and validation duties; Tier 2 handles complex, confirmed incidents requiring deep forensic work. Escalating an unverified brute-force alert would be premature, since first-line analysis must establish whether it is a true positive.

Contacting legal counsel before proceeding

Why it fails: Legal counsel advises on preservation and chain-of-custody obligations, but admissibility hinges on demonstrable integrity of the collected data itself. Contacting lawyers is prudent for privilege and disclosure strategy, yet it neither captures nor authenticates the malware artefacts, so evidence could still be challenged as unverified.

Creating a forensic image of the affected hard drive

Why it fails: A forensic image preserves the disk bit-for-bit, but admissibility also requires documented chain of custody and hashing to prove the copy is unaltered. Imaging is the right step once the server is contained and write blockers are used; here it omits the containment and documentation that authenticate the evidence.

Isolating the server from the network

Why it fails: Isolation preserves the system but does not establish evidence integrity; without a documented chain of custody, collected artefacts remain inadmissible. It is tempting because containment is a standard incident-response step, yet admissibility hinges on chain-of-custody documentation and forensic imaging, not network isolation.

HR

Why it fails: HR handles personnel matters such as employee misconduct or policy breaches, not incident business-impact assessment or strategic response decisions. It is tempting because HR does engage during incidents involving insider threats or staff communications, but the strategic impact and decision-making role belongs to the incident commander or management lead.

Legal counsel

Why it fails: Legal counsel assesses regulatory, contractual and liability exposure, not business impact or strategic incident decisions. It is tempting because counsel genuinely advises on breach notification duties and privilege during incidents, but that scenario involves legal risk assessment, whereas determining business impact and directing strategy sits with incident command.

Incident handler

Why it fails: Incident handlers perform the technical investigation, containment and eradication work rather than owning business impact assessment or strategic decisions. It is tempting because handlers genuinely drive the tactical response and evidence gathering, but that scenario assumes someone else holds command authority; here the strategic and business-impact role is separate.

Remote access policy

Why it fails: A remote access policy governs how external users connect to internal systems, covering VPN, authentication and endpoint requirements, not what sites employees browse. It is tempting because the behaviour involves company resources, but the scenario concerns acceptable use of those resources, not remote connectivity.

Information security policy

Why it fails: An information security policy governs data classification, handling and acceptable use broadly, not specifically web browsing on company resources. It is tempting because it is the umbrella document covering employee conduct, but the acceptable use policy is the one that directly addresses inappropriate website access.

Password policy

Why it fails: A password policy defines complexity, length, expiry and reuse rules for credentials; it says nothing about which websites an employee may visit. It is tempting because it is a familiar security control tied to user accounts, but the behaviour concerns acceptable use of company resources, not authentication strength.

Accept the risk because the mitigation cost is higher than the ALE

Why it fails: Acceptance is unjustified because the $35,000 annual mitigation cost is below the $50,000 ALE, so the control yields a positive return. It is tempting because acceptance suits risks where treatment exceeds expected loss, but here the arithmetic favours mitigation, making acceptance the wrong treatment.

Avoid the risk by discontinuing the activity

Why it fails: Discontinuing the activity eliminates the risk but forfeits the business process generating value, an excessive response when a $35,000 control offsets a $50,000 ALE. It is tempting because avoidance suits risks with no viable control, but mitigation is proportionate here.

Transfer the risk by purchasing cyber insurance

Why it fails: Insurance transfers financial impact but leaves the $50,000 ALE exposure and the threat itself unaddressed, and premiums add recurring cost. It is tempting because transfer suits low-frequency, high-severity risks that are impractical to mitigate, yet here mitigation costs $35,000 annually against a $50,000 ALE, so reduction is justified.