Hard Difficulty Questions

Configuring all system accounts with shared static SSH keys and root auto-login

Why it fails: Shared static SSH keys and root auto-login eliminate per-user accountability and let anyone with the key gain privileged access, so they weaken rather than harden the gateway. It is tempting because it simplifies unattended provisioning and remote administration, which would suit a disposable lab device but never a production industrial endpoint.

Disabling local logging and audit daemons to maximize CPU performance

Why it fails: Disabling local logging and audit daemons removes the evidence trail needed to detect intrusions and diagnose faults, directly undermining endpoint hardening. It is tempting because trimming daemons frees CPU and storage on constrained gateways, yet that trade-off would only be defensible on a non-production device with no security or compliance obligation.

Network Address Translation (NAT) pool overloading

Why it fails: NAT pool overloading multiplexes many internal connections onto few public addresses; it carries no session table across peers, so failover still drops flows. It tempts because NAT exhaustion and port allocation genuinely affect connection handling, and it would be correct if the requirement were conserving public IPv4 addresses rather than preserving state.

Asymmetric routing bypass mode

Why it fails: Asymmetric routing bypass permits return traffic through a different firewall path, which is irrelevant when a single VRRP pair fails over; session continuity requires state synchronisation between peers. It tempts because asymmetric routing genuinely breaks stateful inspection in multi-path designs, so it would be the correct answer if the stem described traffic taking divergent paths.

Dynamic DNS update propagation

Why it fails: Dynamic DNS propagation updates name-to-address mappings after an address change; it does not transfer TCP session state between firewall peers, so established flows still reset. It tempts because failover often coincides with address changes, making DNS the right answer if clients reached the service by hostname and the standby node adopted a new address.

find / -attr +s -type d

Why it fails: find's -attr predicate matches extended attributes and -type d restricts results to directories, so no SUID files are returned. The -perm predicate with the /4000 or -u+s mode tests the setuid bit directly, which is what the hardening scan requires.

locate -i suid_binaries

Why it fails: locate queries a prebuilt filename database and cannot filter on permission bits, so it returns nothing relevant to SUID status. It suits quickly finding files by name; the -perm -4000 predicate on find is what inspects the setuid bit itself.

chmod -R 755 /

Why it fails: chmod alters permissions rather than reporting them, and 755 clears the SUID bit on every file under root, breaking legitimate binaries. find with -perm -4000 lists setuid files; chmod is for changing modes once findings are reviewed.

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Why it fails: SameSite=Strict blocks cookies from being sent on cross-site requests, mitigating CSRF, and Max-Age only sets cookie lifetime; neither prevents JavaScript reading document.cookie nor protects data in transit. They would suit session-expiry and CSRF hardening, but the stem demands HttpOnly and Secure against XSS theft and sniffing.

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Why it fails: Domain and Path scope which URLs receive the cookie, limiting exposure breadth, but JavaScript can still read the cookie and plaintext HTTP still exposes it. These attributes suit constraining cookie transmission across subdomains or directories, not defeating XSS exfiltration or network sniffing, which require HttpOnly and Secure.

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Why it fails: Partitioned (CHIPS) isolates cookies per top-level site, defending against cross-site tracking and some CSRF, while HttpOnly blocks JavaScript access. It addresses XSS theft but leaves network sniffing unaddressed; Secure is required to force HTTPS transmission. CHIPS suits embedded third-party contexts, not this scenario's dual requirement.

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Why it fails: Route 53 Resolver DNS Firewall filters domain-name resolution queries, not individual packets traversing subnets; intra-subnet filtering is performed by security groups and network ACLs. It is tempting because it is a genuine VPC security control, and would be correct for blocking resolution of malicious or unwanted domains.

AWS Shield Standard for intra-VPC subnet routing

Why it fails: AWS Shield Standard provides DDoS protection at the edge; it does not route or filter traffic between subnets inside a VPC, which security groups and network ACLs handle. It is tempting because it is a free, always-on security feature, and would be correct for absorbing volumetric DDoS attacks against public endpoints.

Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts

Why it fails: Disabling TCP/IP removes the transport SQL Server uses for client connections, while NetBIOS frame broadcasts are a legacy non-routable protocol, not a database access method. It tempts as network hardening, but protocol restriction should retain TCP/IP with encryption and firewall rules instead.

Granting db_owner permissions to all public database roles by default

Why it fails: Granting db_owner to public gives every database user full control, including schema modification and permission escalation, defeating least privilege. It is tempting as a quick way to remove access errors during deployment, but db_owner belongs only to specific trusted administrators, never the public role.

http.cors.enabled: true and http.cors.allow-origin: "*"

Why it fails: Enabling CORS with a wildcard origin permits any browser-based domain to issue cross-origin requests to the cluster, directly undermining access control rather than enforcing authentication and TLS. It tempts because CORS configuration is a legitimate Elasticsearch setting for web clients, but it addresses browser access, not transport encryption or identity verification.

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Why it fails: Setting network.host to 0.0.0.0 binds Elasticsearch to every interface, exposing the cluster, while routing allocation governs shard placement, not security. It tempts because binding is a real configuration task during cluster setup, but it delivers reachability rather than the authentication and TLS enforcement the scenario demands.

discovery.type: single-node without password configuration

Why it fails: Single-node discovery with no password leaves the cluster unauthenticated and unencrypted, the opposite of the required controls. It tempts because single-node mode is a valid configuration for development or isolated testing, where convenience outweighs exposure, but it provides no identity verification or transport security for production PII.

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Why it fails: Storage discovery DLP examines data at rest in repositories; it cannot inspect live SIP VoIP streams, which is a network DLP capability. Network DLP would be correct where real-time interception of voice traffic for card data is required.

Intercepting local USB thumb drive file copy operations inline on endpoints

Why it fails: Storage discovery DLP scans data at rest on file shares, databases, and object stores; it does not intercept USB copy operations, which is an endpoint DLP function. Endpoint agents are the correct choice when blocking local removable-media transfers is the requirement.

As a confidence value assigned to the intelligence report

Why it fails: Infrastructure is one of the Diamond Model's four core vertices, describing physical or logical assets such as servers and domains, not a confidence rating. It is tempting because confidence metadata accompanies intelligence reporting, but that is a separate analytic property, not a Diamond vertex.

As an external social-political requirement

Why it fails: Social-political requirements sit in the Meta-features axis, capturing external pressures shaping an adversary's operations. Infrastructure is a core Diamond vertex covering the physical and logical assets (servers, domains, IPs) used to deliver and control activity. Meta-features would be correct when classifying contextual drivers rather than hosting assets.

As a meta-feature used exclusively for tracking timestamps

Why it fails: Timestamps belong to the Meta-features axis, which records temporal, kill-chain and phase data about an event, not adversary assets. Infrastructure is itself a core Diamond vertex describing physical or logical C2, staging and exfiltration resources. Meta-features would be the right classification when logging when an intrusion phase occurred.

Enforce User Account Control (UAC) with highest privilege elevation prompts.

Why it fails: UAC gates privilege elevation through consent prompts on the local machine, but pass-the-hash reuses a harvested NTLM hash directly against remote services without triggering an elevation prompt. UAC suits limiting interactive administrator rights, not neutralising stolen credential material.

Configure Windows Defender Exploit Guard with Network Protection enabled.

Why it fails: Network Protection blocks outbound connections to malicious hosts and IP addresses, which addresses command-and-control and phishing traffic, not local credential reuse. Pass-the-hash authenticates to legitimate internal services, so the hash remains usable; Network Protection suits egress filtering scenarios.

Deploy BitLocker Drive Encryption with TPM 2.0 hardware backing on all endpoints.

Why it fails: BitLocker encrypts data at rest on the volume, protecting contents if a disk is removed, but it does not alter how NTLM hashes are used during network authentication, so pass-the-hash still succeeds. It is the right control for lost-device confidentiality, not credential theft.

Disabling log verbosity to prevent storage overhead on the central syslog collector

Why it fails: Reducing verbosity removes the user activity, exception and event records the control requires to be produced and kept, so review has nothing to examine. Retaining full logging with tiered storage or filtering at analysis time would be correct where storage cost, not log content, is the constraint.

Exporting raw log text files to an unindexed USB drive stored in a desk drawer once per quarter

Why it fails: Unindexed quarterly exports prevent timely correlation and review, and removable media in a drawer defeats retention and access governance. Centralised, indexed log management with automated alerting and retention would be correct when the requirement is searchable, auditable review at defined intervals.

Relying entirely on end users to manually report anomalous log entries via email

Why it fails: User-reported anomalies are neither automated nor systematic, so exceptions and security events go unreviewed unless noticed. Automated correlation and alerting on the central collector would be correct where the control demands continuous, repeatable review rather than relying on human vigilance.

Strict TCP handshake validation

Why it fails: Strict TCP handshake validation only enforces correct sequence and flag ordering within a single flow; it cannot share state between two firewalls, so Firewall B still drops the SYN-ACK as out-of-state. It is tempting because it hardens TCP against spoofing and scans, which is its actual purpose.

Unicast RPF (Reverse Path Forwarding)

Why it fails: Unicast RPF checks that the packet's source is reachable via the receiving interface, so it would actively drop traffic in an asymmetric path rather than synchronise state. It is tempting because it validates path consistency, and it is correct when defending against IP spoofing on symmetric networks.

NAT hairpinning

Why it fails: NAT hairpinning lets internal hosts reach an internal server via its public address; it does nothing to replicate session tables across two firewalls. It is tempting because hairpinning also addresses routing oddities, but it is the correct choice only when internal clients must loop back through the perimeter.

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Why it fails: aa-enforce is used to set profiles to enforcing mode, not complain mode.

systemctl set-mode apparmor=complain

Why it fails: systemctl does not take an apparmor mode argument; AppArmor is managed via its own utilities.

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Why it fails: The apparmor_parser command with -C checks policy syntax rather than dynamically changing the running profile mode for a single application.

TCP Selective Acknowledgments (SACK)

Why it fails: SACK helps efficiently recover from lost packets without retransmitting the entire window, unrelated to SYN flood mitigation.

TCP Window Scaling

Why it fails: TCP window scaling is designed to improve throughput over high-bandwidth, high-latency links, not mitigate SYN floods.

Reverse Path Forwarding (RPF) strict mode

Why it fails: RPF checks packet source IPs against routing tables to prevent IP spoofing, not SYN floods.

Azure Backup Vault with geo-redundant storage (GRS)

Why it fails: Azure Backup Vault with GRS stores backup copies, not continuously replicated VM disks, so it cannot provide the asynchronous cross-region disk replication the scenario demands. It is tempting because GRS does replicate backup data across regions, which suits long-term retention and restore-from-backup scenarios rather than low-RPO disaster recovery failover.

Azure ExpressRoute Global Reach

Why it fails: ExpressRoute Global Reach links on-premises networks through Microsoft's backbone; it carries no VM disk replication between Azure regions, so it cannot satisfy the asynchronous cross-region replication requirement. It is tempting because it connects regions privately, which suits hybrid connectivity or inter-region network traffic scenarios rather than disaster recovery replication.

Azure Traffic Manager with priority routing

Why it fails: Traffic Manager with priority routing only distributes client traffic to endpoints; it neither replicates VM disks nor provisions secondary VMs, so no cross-region disk copy exists to fail over to. It is tempting because it does orchestrate regional failover, which suits scenarios where replicated VMs or apps already exist in both regions.

AWS Client VPN with split tunneling disabled

Why it fails: Client VPN terminates remote user sessions into a VPC; it does not provide service-to-service connectivity between VPCs. It is tempting because it encrypts traffic without public exposure, and would be correct for granting individual remote workers private access to internal resources.

AWS Direct Connect Gateway with transit VIF

Why it fails: A Direct Connect Gateway with a transit VIF links on-premises networks to VPCs over private connectivity; it does not broker service-to-service traffic between VPCs. It is tempting because it avoids public internet exposure, and would be correct for hybrid connectivity from a data centre into multiple VPCs.

Inter-Region VPC Peering with restrictive Network Security Groups

Why it fails: Inter-Region VPC Peering connects entire VPC CIDR ranges, so any subnet can reach any other, violating the requirement to avoid full subnet access. It is tempting because peering is private and simple, and would be correct when two VPCs must share broad, trusted connectivity.

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Why it fails: TDE encrypts data at rest on disk and storage, leaving query parsing and parameter handling untouched, so injection remains possible. TDE is correctly chosen to protect data files and backups from physical theft or media loss.

TDE eliminates the need for database user access controls and role-based permissions

Why it fails: TDE protects data at rest only; authentication, authorisation and role-based permissions still govern access to decrypted data in memory. TDE is the right control when the requirement is protecting stored files and backups, not enforcing user privileges.

The Master Boot Record (MBR) partition table sectors

Why it fails: The MBR holds boot code and partition layout, not WMI artefacts, so it yields nothing about fileless execution. It is tempting because it is a classic persistence location, and it would be correct when investigating bootkits, but WMI investigations require the repository, event subscription and WMI-Activity operational logs.

The system HOSTS file in \Windows\System32\drivers\etc\

Why it fails: The HOSTS file maps hostnames to IP addresses and records no WMI activity, so it cannot evidence fileless execution. It is tempting because it is a common persistence and redirection location, and it would be correct when investigating DNS hijacking, but WMI analysis requires repository objects, event subscriptions and WMI-Activity logs.

icmp.type == 8

Why it fails: icmp.type == 8 selects all echo requests regardless of payload length.

udp.length > 32

Why it fails: This filters UDP packets, not ICMP.

ip.proto == 6 && tcp.len > 32

Why it fails: ip.proto 6 represents TCP, not ICMP.

Run sp_configure 'enforce network encryption', 1; on the master instance

Why it fails: No such 'enforce network encryption' option exists in sp_configure; SQL Server encrypts replica traffic by requiring the availability group's database mirroring endpoint to use encryption. Tempting because it sounds like a global switch, it would be correct only if such a server-level setting genuinely existed.

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Why it fails: Compatibility level and Always Encrypted with secure enclaves protect column data from the database engine and client drivers; they do not encrypt the availability group's replica-to-replica transport. Tempting as a modern encryption feature, it would be correct only for client-side column encryption, not for securing the database mirroring endpoint.

Enable Transparent Data Encryption (TDE) on the primary replica database

Why it fails: TDE encrypts data and log files at rest on disk, leaving the wire protocol between replicas unencrypted. It is tempting because it is the headline SQL Server encryption feature, but it would be correct only for protecting data files and backups, not for encrypting the mirroring endpoint traffic the scenario requires.