Hard Difficulty Questions

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Why wrong: MFA is useful, but direct access from every corporate laptop still expands the attack surface and makes lateral movement much easier after an endpoint compromise. The scenario explicitly asks to stop direct management access and reduce spread, so a central jump path is better than broad direct reachability.

Expose SSH to the internet because key-based authentication is already strong.

Why wrong: Publicly exposing SSH is unnecessary and increases brute-force, scanning, and exploitation risk. Key-based authentication helps, but it does not justify direct internet access to management services. The requirement is to remove direct access from employee laptops, not extend management services to untrusted networks.

Use split tunneling for admin traffic so management packets can bypass the VPN.

Why wrong: Split tunneling is generally used to route some traffic outside the secure tunnel, which is the opposite of what this scenario needs. Management traffic should be tightly controlled and inspected, not routed around security controls. Bypassing the VPN would weaken the protected management path.

Run one server and keep nightly backups in cloud object storage.

Why wrong: Backups help recovery after loss, but they do not provide automatic service continuity during an outage.

Deploy active-active multi-region capacity with identical production load in both regions.

Why wrong: Active-active meets the availability goal, but it usually costs more than the scenario allows and duplicates production capacity.

Add RAID 1 and a spare power supply to the database server.

Why wrong: These hardware controls improve a single server’s reliability, but they do not address a site outage or application-level failover.

Share the full file by email as Confidential because only the last four digits of the SSN are included.

Why wrong: Last-four SSN data is still sensitive, and the file also contains address, balance, and support notes that require stronger handling.

Label it Public because the contractor needs the information to troubleshoot effectively.

Why wrong: Business convenience does not change the classification of customer data containing personally identifiable and financial details.

Mark it Internal and place it on the shared project drive for easy access.

Why wrong: Internal sharing is too broad for customer records and does not satisfy the minimization and approval requirements shown in the policy.

Increase the backup schedule from nightly to hourly.

Why wrong: More backups help recovery, but they do not detect suspicious file access or exfiltration in real time.

Rename the share to a less obvious name.

Why wrong: Security by obscurity does not detect misuse and does not stop a valid account from accessing files.

Disable SMB signing so the file transfer runs faster.

Why wrong: Disabling signing weakens integrity protections and does not address the core detection gap.

Restore the workstation from backup immediately before preserving any evidence.

Why wrong: Immediate restoration could destroy forensic evidence and does not stop the attacker from continuing lateral movement elsewhere.

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Why wrong: That may help later in root cause analysis, but it is not the priority while the compromise is still active.

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Why wrong: The logs show ongoing malicious activity, so waiting would increase business impact and spread risk significantly.

Keep the current shell command, but add HTML encoding to the response page.

Why wrong: Output encoding helps prevent browser-side issues, but it does not stop command injection on the server.

Increase the web server timeout so the ping utility has more time to complete.

Why wrong: Timeout tuning does not prevent an attacker from appending extra shell commands to the request.

Require users to authenticate before they can access the page.

Why wrong: Authentication may reduce exposure, but it does not correct the underlying unsafe command execution.

Guideline, because it provides flexible advice without requiring enforcement.

Why wrong: Guidelines are optional recommendations. They are useful for advice, but the objective here is to make behavior mandatory and auditable, so a guideline is too weak.

Procedure, because it lists the exact steps the help desk follows.

Why wrong: A procedure explains how a task is performed, but it is not usually the best place to establish organization-wide mandatory approval authority or retention requirements.

Architecture diagram, because it shows where documents are stored.

Why wrong: An architecture diagram can illustrate systems or data flows, but it does not define mandatory business rules, approval authority, or evidence retention requirements.

Deploy immediately because the issue is customer-facing and urgent.

Why wrong: Urgency does not remove the need for basic change controls when the exhibit shows skipped tests and no rollback plan.

Close the ticket after deployment and create a postmortem if users complain.

Why wrong: A post-implementation review is useful, but it cannot replace required pre-release approvals, testing, and rollback planning.

Ask support to warn users that sign-in may fail during the next hour.

Why wrong: Customer communication may help operations, but it does not address the unsafe release process shown in the exhibit.

Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

Why wrong: This is far broader access than the task requires. Domain administration would let the technician change far more than one account and one MFA token, which increases risk significantly. A time limit helps a little, but it still violates least privilege because the permissions are excessive for the work being performed.

Use a shared administrator password so the technician can finish the ticket without changing group memberships.

Why wrong: Shared credentials remove accountability and make it impossible to attribute actions to a specific person. They also create a much larger blast radius if the password is exposed. This option is operationally convenient, but it is one of the least secure ways to grant access and does not follow least privilege.

Ask the user's manager to perform the reset manually so the help desk does not need additional access.

Why wrong: This avoids granting permissions, but it is not the most practical or secure operational answer because it shifts work to someone who may not have the right tools or training. Least privilege is about giving the correct limited access to the right role, not simply avoiding access requests altogether. The help desk role already exists for this purpose.

Add a second nightly full backup at 23:30 to the same NAS device.

Why wrong: A second full backup on the same storage does not materially improve restore speed or the data-loss window.

Move the NAS to a different VLAN but keep the backup schedule unchanged.

Why wrong: Segmentation may reduce exposure, but it does not address the long restore duration or the poor RPO.

Increase backup retention from one month to one year.

Why wrong: Longer retention helps compliance and historical recovery, but it does nothing to improve recovery speed or freshness.

Directive control

Why wrong: Directive controls tell people what they should do, such as policies, procedures, standards, or mandatory guidance.

Detective control

Why wrong: Detective controls would report the firewall drift, but they would not actively restore the approved configuration.

Deterrent control

Why wrong: Deterrent controls are meant to discourage bad behavior through visible consequences, such as warning banners or cameras.

ARP poisoning causing the host to redirect traffic to a rogue gateway

Why wrong: ARP poisoning would mainly affect local layer-2 behavior, not produce repeated suspicious DNS subdomain lookups with NXDOMAIN responses.

A browser cache synchronization feature repeatedly polling a cloud service

Why wrong: Legitimate synchronization usually generates consistent service traffic and valid endpoints, not random-looking subdomains and repeated failures.

A misconfigured static route sending all web traffic to the wrong subnet

Why wrong: A routing error would affect broader connectivity, but it would not specifically create this distinctive DNS query pattern.

Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

Why wrong: A consumer antivirus tool does not provide corporate workspace isolation or conditional access enforcement.

Install a VPN app on the tablets and let users choose their own lock-screen settings.

Why wrong: A VPN encrypts traffic, but it does not separate corporate and personal data or enforce device compliance.

Use application allowlisting alone and avoid enrolling the tablets in a management platform.

Why wrong: Allowlisting can limit apps, but it does not provide selective wipe, posture validation, or full device governance.

Least privilege, because each person gets only the minimum access needed for the task.

Why wrong: Least privilege is part of the redesign, but it is not the primary principle being enforced by the workflow separation. The audit finding is about one person being able to create, approve, and deploy the same change. The proposed fix is designed mainly to ensure no single person controls the entire process from start to finish.

Defense in depth, because multiple layers of security are added around firewall changes.

Why wrong: Defense in depth would involve layered technical and administrative controls, such as logging, approvals, and segmentation. While those may exist in the background, the exhibit focuses on dividing duties among different people. The core issue is not the number of layers, but who is allowed to perform each stage of the change process.

Need-to-know, because the ticket is visible only to assigned people.

Why wrong: Need-to-know is reflected in the limited ticket visibility, but it is not the main issue highlighted by the audit note. The problem is that one person can request, approve, and deploy the change. The redesign primarily prevents one individual from having excessive control over a sensitive process, which is separation of duties.

Keep the current design and add more NAS storage capacity.

Why wrong: More capacity does not improve survivability. The backup target is still online, writable, and reachable with the same credentials.

Move the NAS to the same subnet as the file server for faster backups.

Why wrong: Putting the backup target closer to production may improve speed, but it increases exposure to the same compromise path.

Shorten the backup retention period to reduce storage use.

Why wrong: Reducing retention may save space, but it also reduces recovery options and does not protect backups from encryption.

db-lab02, because high-severity findings always outrank medium and critical findings.

Why wrong: Severity alone is not enough; exposure and business impact are critical to prioritization.

printsrv03, because it is internet-facing and has no vendor patch available.

Why wrong: Although it is exposed, the temporary ACL reduces risk and there is no immediate fix to apply.

None of these, because the team should wait for the next quarterly review before changing anything.

Why wrong: Deferring all work would ignore an exploitable internet-facing critical vulnerability with an available fix.

Store the private key on the same backup server so recovery is faster.

Why wrong: Putting the private key on the same server creates a single point of failure and weakens key protection. If the server is lost, compromised, or destroyed, the organization may also lose the ability to decrypt the backup key material.

Replace AES with hashing so the archive no longer needs a key.

Why wrong: Hashing is one-way and cannot be used to restore encrypted backup data. It is useful for integrity checks, not for decrypting archives. This suggestion would eliminate recoverability rather than improve it.

Send the private key to backup operators by email so they can restore data quickly.

Why wrong: Emailing the private key exposes it to interception, forwarding, and unauthorized access. That undermines key confidentiality and creates unnecessary risk. Recovery should be possible without distributing the private key broadly or insecurely.

Internal HR file server

Why wrong: The score is high, but the server is not directly internet-exposed and has layered controls that reduce immediate attack likelihood.

Lab workstation

Why wrong: Although severe, the lab is isolated from production, so the business impact and likelihood are much lower than an exposed perimeter device.

DMZ reporting server

Why wrong: The server is exposed, but the WAF and allowlist reduce practical exploitability compared with the VPN appliance that has no compensating controls.

SQL injection is present because the customerId value changes in the URL.

Why wrong: A parameter changing from one integer to another does not by itself indicate SQL injection. SQL injection would require evidence that the application is interpreting malicious SQL syntax, such as quotes, comments, or database error behavior. Here, the clue is unauthorized object access, not database query manipulation.

Cross-site scripting is present because the invoice data is returned in the browser.

Why wrong: Receiving another user's invoice in the browser is not evidence of script injection. Cross-site scripting requires malicious script execution in a victim's browser context. The scenario describes unauthorized data disclosure through an identifier change, which is an access-control problem rather than a content-injection issue.

Insecure deserialization is present because the request uses JSON-like parameters.

Why wrong: The presence of request parameters or JSON formatting does not imply insecure deserialization. That weakness involves tampering with serialized objects or object state during parsing. The scenario provides no evidence of object deserialization, integrity bypass, or gadget-chain exploitation.

Delete the scheduled task immediately so the host returns to normal operation.

Why wrong: Deleting artifacts too early can destroy evidence and does not guarantee the malware is removed. It may also cause the attacker to react or trigger secondary payloads. Containment and collection should come before destructive cleanup.

Reimage the workstation from the golden image as the first response.

Why wrong: Reimaging is a remediation step, but it is too early if the team still needs evidence and scope. It can wipe useful traces of execution, persistence, and command-and-control activity before they are preserved.

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.

Why wrong: Built-in tools are often abused by attackers, so the mere presence of PowerShell does not make the event benign. The suspicious execution chain and beaconing behavior require investigation and containment, not dismissal.