Hard Difficulty Questions

Use multi-stage builds

Why it fails: Multi-stage builds help reduce final image size but not necessarily base image packages.

Combine multiple RUN commands into one

Why it fails: Combining RUN statements reduces layers but not the packages installed.

Delete the apt cache in the Dockerfile

Why it fails: Deleting cache reduces image size but does not remove unnecessary utilities.

Deploying VLANs to separate cardholder data from other traffic

Why it fails: VLANs segment Layer 2 broadcast domains but do not enforce identity-aware, per-flow policy between workloads, which zero trust requires. It is tempting because VLANs are the traditional PCI DSS CDE isolation method, yet they alone cannot deliver microsegmentation.

Using network access control (NAC) to enforce endpoint compliance

Why it fails: NAC enforces endpoint posture at connection time; it does not isolate cardholder data flows to shrink PCI DSS scope. It is tempting because NAC underpins zero trust access decisions, but segmentation of the CDE requires enforcing policy between workloads, not endpoint admission checks.

Placing all systems that process cardholder data in a DMZ

Why it fails: A DMZ isolates internet-facing services, not internal cardholder data systems, and does not provide east-west microsegmentation. It is tempting because DMZs are a recognised PCI DSS segmentation control for public-facing components, but placing the whole CDE there misapplies the pattern.

Verify the provider's data center locations comply with data residency laws

Why it fails: Data residency affects where PHI is stored but does not create the legal obligation governing the provider's handling of PHI; without a Business Associate Agreement the disclosure itself is non-compliant. It is tempting for jurisdictional compliance, which suits EU or sector-specific localisation rules, but HIPAA mandates the BAA first.

Review the provider's SOC 2 Type II report

Why it fails: SOC 2 Type II attests security controls over time but does not satisfy HIPAA's requirement for a signed Business Associate Agreement before PHI is disclosed to the provider. It is tempting as vendor due diligence evidence, which suits general security assurance, yet the stem demands the BAA as the critical pre-contract requirement.

Ensure all data is encrypted at rest and in transit

Why it fails: Encryption at rest and in transit is a safeguard, not the contractual prerequisite; HIPAA requires a Business Associate Agreement before PHI is shared with the provider, and encryption alone leaves that obligation unmet. It is tempting as a core technical control, which suits breach-risk reduction, but the stem asks for the critical pre-contract compliance requirement.

Disable root login inside the container by modifying /etc/passwd

Why it fails: Disabling root login does not prevent the container process from running as root; the process still has root privileges.

Use a read-only root filesystem for the container

Why it fails: A read-only filesystem limits writes but does not reduce privileges; the container still runs as root.

Enable SELinux or AppArmor on the host

Why it fails: These are mandatory access control mechanisms that can confine a process, but they do not directly address the root privilege issue; combining with non-root user is better.

Right to unlimited data storage

Why it fails: GDPR grants no right to unlimited storage; Article 5(1)(e) instead imposes storage limitation, requiring data be kept no longer than necessary. It tempts because organisations do retain data indefinitely in practice, and long retention is lawful only where a specific legal basis or statutory obligation justifies it.

Right to data monetization

Why it fails: GDPR confers no right to monetise data; processing personal data for profit requires a lawful basis plus transparency, and data subjects hold rights such as access, erasure and portability instead. It tempts because organisations do commercialise aggregated data, which is lawful only when properly anonymised or consented.

Falcon

Why it fails: Falcon is a NIST-selected digital signature scheme, so it provides authentication and integrity rather than the key encapsulation mechanism general encryption needs. It is tempting because it is a legitimate post-quantum standard, and it would be correct if the scenario required signing rather than encrypting data.

CRYSTALS-Dilithium

Why it fails: CRYSTALS-Dilithium is a NIST post-quantum signature algorithm, not key encapsulation, so it cannot provide the general encryption the scenario requires. It is tempting because it is a genuine NIST PQC selection, but it belongs in digital-signature and authentication use cases, whereas CRYSTALS-Kyber was chosen for key encapsulation.

SPHINCS+

Why it fails: SPHINCS+ is a stateless hash-based signature scheme selected by NIST for digital signatures, not for key encapsulation. It is the correct choice when long-term signature security against quantum attack is required, whereas general encryption needs ML-KEM (CRYSTALS-Kyber).

Continuous deployment

Why it fails: Continuous deployment focuses on delivery automation, not security.

Code signing

Why it fails: Code signing verifies authenticity after development, not a core SSDLC process step.

Allow all traffic within the corporate network

Why it fails: Zero trust removes implicit trust from the network perimeter, requiring every request to be authenticated and authorised; permitting all internal traffic reinstates the flat-network model zero trust eliminates. It tempts as a legacy convenience for trusted subnets, but that is precisely the assumption being retired.

Trust devices based on their IP address

Why it fails: IP addresses are spoofable and workload identities move, so zero trust authenticates device identity and posture rather than network location. It tempts because static IP allow-lists are simple to configure, but that is perimeter-based trust, which zero trust explicitly replaces with identity-based verification.

Trust but verify for all internal traffic

Why it fails: Zero trust never grants standing trust to internal traffic; each session and request is continuously verified regardless of origin. It tempts because 'trust but verify' describes older defence-in-depth postures, yet zero trust's mechanism is explicit per-request policy evaluation, not network-location-based trust.

Manual review of compliance reports quarterly

Why it fails: Quarterly manual review samples compliance at four points per year, leaving gaps between checks, so it cannot evidence continuous monitoring. It is tempting because periodic attestation satisfies annual audit requirements and suits low-risk, stable environments where automation overhead is unjustified.

Deploying a Security Information and Event Management (SIEM) system

Why it fails: A SIEM aggregates and correlates log events for security detection, but it does not itself evaluate configuration against compliance baselines or remediate drift. It is tempting because SIEMs ingest broad telemetry and support reporting; they are the right choice for threat detection and incident response, not configuration compliance monitoring.

Annual external audits

Why it fails: Annual external audits provide a point-in-time opinion, not ongoing telemetry, so drift between audits goes undetected. They are tempting because regulators and customers accept them as formal assurance, and they suit organisations needing independent validation rather than continuous operational monitoring.

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Why it fails: Unnecessary complexity; TLS is sufficient and IPsec may increase latency.

Move all applications to a single region to simplify key management and use a single shared load balancer

Why it fails: Eliminates disaster recovery and increases risk of regional failure.

Use client-side encryption with keys stored in the application code and disable the health checks entirely

Why it fails: Storing keys in code is insecure; disabling health checks may cause availability issues.

The agency no longer needs to conduct any risk assessments

Why it fails: Agency retains responsibility

The CSP guarantees 100% security

Why it fails: No guarantee

The system automatically complies with all international regulations

Why it fails: Only FedRAMP

The policy restricts access to specific resources

Why it fails: The policy allows all resources (Resource: *).

The policy does not enable logging

Why it fails: Logging is not covered by this policy document.

The policy does not allow any actions

Why it fails: The policy allows all actions (Action: *).

Runtime application self-protection (RASP) deployment

Why it fails: RASP instruments a running application to detect and block attacks at execution time, so it belongs to the operations and maintenance phase, not development. RASP would be the correct choice when hardening a deployed application against live runtime exploitation.

Penetration testing on production environment

Why it fails: Penetration testing targets a deployed, running system, placing it in testing or operations rather than the development phase. It would be the correct activity when validating a completed build in a staging or production environment before release.

Intrusion prevention system (IPS)

Why it fails: IPS detects and blocks threats but does not make policy-based access decisions.

Web application firewall (WAF)

Why it fails: A WAF inspects HTTP traffic for exploits and filters requests by IP, signature or rate; it cannot evaluate user identity, device posture or contextual signals to authorise access. A policy engine with a policy administrator and enforcement point does that. WAFs are correct for shielding public web applications from injection and DDoS traffic.

Network access control (NAC)

Why it fails: NAC admits or quarantines devices at the network layer based on port, certificate or posture agent, but it does not evaluate user identity and context per request to authorise application access. A policy engine and enforcement point perform that. NAC suits onboarding and segmenting managed endpoints on a corporate LAN.

Relying on the vendor's own marketing materials and public certifications page to confirm its security posture

Why it fails: Marketing content and public badge pages are self-selected and unverified, so they provide no reliable evidence about the controls actually protecting the bank's data. Examiners expect independent validation through reports, assessments, or contractual assurances, not vendor-authored promotional claims, which is why this practice fails to demonstrate meaningful continuous oversight.

Ranking vendors solely by annual contract value and assigning oversight resources proportionally to spend

Why it fails: Contract value does not correlate with the sensitivity of data accessed or the operational criticality of the vendor, so spend-based ranking can under-supervise a low-cost vendor holding regulated customer data. Risk tiering should consider data classification, system access, and business dependency, making this approach a misallocation of oversight rather than a continuous monitoring practice.

Collecting a completed security questionnaire from each vendor once during initial onboarding and archiving the response

Why it fails: A questionnaire completed at onboarding captures the vendor's posture on a single date and becomes stale as the vendor's environment, personnel, and controls change. Archiving it without refresh means the bank relies on outdated self-reported information, so this practice reflects initial due diligence rather than the continuous oversight the examination is probing for.

Falcon

Why it fails: Falcon is a NIST-selected post-quantum signature scheme, but it was standardised as FN-DSA (FIPS 206), still in draft, rather than the finalised FIPS 204 ML-DSA. Falcon suits constrained environments needing small signatures; the stem asks for the standardised algorithm, which is ML-DSA.

RSA-4096

Why it fails: RSA-4096 relies on integer factorisation, which Shor's algorithm breaks on a sufficiently large quantum computer, so it offers no quantum resistance. It is tempting because larger keys extend classical security, and RSA-4096 would be correct for resisting conventional attacks under current standards.

CRYSTALS-Kyber

Why it fails: CRYSTALS-Kyber is standardised for key encapsulation, not digital signatures, so it cannot sign certificates in a PKI. It is tempting because it is a genuine NIST post-quantum standard, and Kyber would be correct for establishing shared symmetric keys between parties.

Reverse proxy

Why it fails: A reverse proxy sits in front of the cloud app, so it only sees traffic routed through that app's infrastructure and cannot inspect unsanctioned SaaS use from unmanaged devices. It is the right choice when protecting a self-hosted service and hiding origin servers.

Forward proxy

Why it fails: A forward proxy requires device or browser configuration, such as a PAC file or agent, to direct user traffic through it, contradicting the no-device-modification requirement. It is correct when managed endpoints can be configured to route outbound web requests.

Inline gateway

Why it fails: An inline gateway is a network-integrated deployment requiring traffic to traverse it, typically via network changes or agents on the device, which the scenario excludes. It is correct when the organisation controls the network path and can steer traffic through the gateway.

Elliptic Curve Diffie-Hellman (ECDH)

Why it fails: ECDH relies on the elliptic-curve discrete-logarithm problem, which Shor's algorithm solves on a sufficiently large quantum computer, so it cannot resist quantum attack. It is tempting because ECDH is a proven classical key-agreement method, and it would be the right choice for conventional TLS key exchange where quantum resistance is not required.

RSA-4096

Why it fails: RSA-4096's security rests on integer factorisation, which Shor's algorithm defeats on a quantum computer, so larger key sizes do not deliver quantum resistance. It is tempting because RSA-4096 is a widely deployed, strong classical asymmetric algorithm, and it would be correct where only classical attackers are in scope.

Apply a virtual patch using a web application firewall (WAF) rule

Why it fails: WAF can mitigate web-based attacks but may not cover all vulnerability types if the application is not web-based.

Disable the application until a replacement is found

Why it fails: Disabling would impact business operations, which is not the goal.

Increase monitoring of the application without any access restrictions

Why it fails: Monitoring alone does not prevent exploitation.

volatility -f dump.raw clipboards

Why it fails: Incorrect syntax; the correct plugin name is 'clipboard'.

volatility -f dump.raw windows.clipboard

Why it fails: Incorrect plugin name; the correct name is 'clipboard'.

volatility -f dump.raw memdump --pid 1234

Why it fails: This dumps the memory of a specific process, not the clipboard.