Select Two (Multi-Select) Questions

Configuring all system accounts with shared static SSH keys and root auto-login

Why it fails: Shared static SSH keys and root auto-login eliminate per-user accountability and let anyone with the key gain privileged access, so they weaken rather than harden the gateway. It is tempting because it simplifies unattended provisioning and remote administration, which would suit a disposable lab device but never a production industrial endpoint.

Disabling local logging and audit daemons to maximize CPU performance

Why it fails: Disabling local logging and audit daemons removes the evidence trail needed to detect intrusions and diagnose faults, directly undermining endpoint hardening. It is tempting because trimming daemons frees CPU and storage on constrained gateways, yet that trade-off would only be defensible on a non-production device with no security or compliance obligation.

Disabling endpoint firewall protection to improve home network gaming performance

Why it fails: Disabling the endpoint firewall removes host-based filtering of inbound and outbound traffic, directly contradicting a remote work security policy that must enforce protective controls. It is tempting because gamers sometimes disable firewalls to fix connectivity or latency, but that is a troubleshooting workaround, not a security control.

Sharing corporate laptop credentials with family members for household convenience

Why it fails: Credential sharing destroys individual accountability and non-repudiation, since audit logs can no longer attribute actions to a single employee, and it violates least-privilege access to corporate resources. It is tempting as a convenience measure for households sharing one device, but shared accounts are only ever acceptable for non-sensitive, non-attributable services.

Connecting directly via unencrypted public Wi-Fi without any protective tunneling

Why it fails: Unencrypted public Wi-Fi with no tunnelling exposes credentials and session data to interception and on-path attackers on the same network. It is tempting because it requires no configuration and works anywhere, but direct public Wi-Fi access is only tolerable when a VPN or TLS tunnel protects the traffic end to end.

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Why it fails: Route 53 Resolver DNS Firewall filters domain-name resolution queries, not individual packets traversing subnets; intra-subnet filtering is performed by security groups and network ACLs. It is tempting because it is a genuine VPC security control, and would be correct for blocking resolution of malicious or unwanted domains.

AWS Shield Standard for intra-VPC subnet routing

Why it fails: AWS Shield Standard provides DDoS protection at the edge; it does not route or filter traffic between subnets inside a VPC, which security groups and network ACLs handle. It is tempting because it is a free, always-on security feature, and would be correct for absorbing volumetric DDoS attacks against public endpoints.

Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts

Why it fails: Disabling TCP/IP removes the transport SQL Server uses for client connections, while NetBIOS frame broadcasts are a legacy non-routable protocol, not a database access method. It tempts as network hardening, but protocol restriction should retain TCP/IP with encryption and firewall rules instead.

Granting db_owner permissions to all public database roles by default

Why it fails: Granting db_owner to public gives every database user full control, including schema modification and permission escalation, defeating least privilege. It is tempting as a quick way to remove access errors during deployment, but db_owner belongs only to specific trusted administrators, never the public role.

Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).

Why it fails: A SPAN port or TAP delivers copies of traffic passively, so the device can only detect and alert; it cannot drop or block packets inline. Passive monitoring fits an IDS deployment, whereas a NIPS must sit inline in the traffic path to prevent intrusions.

Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.

Why it fails: A pure Layer 2 bridge that inspects no network-layer or transport-layer headers cannot match signatures or enforce policy, so it cannot detect or block attacks. Bridging without inspection describes a transparent forwarding device, not a NIPS, which must parse headers to identify and prevent intrusions.

Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.

Why it fails: Syslog alerting without affecting packet delivery describes passive, out-of-band detection, which is IDS behaviour; a NIPS must sit inline and actively drop or reset malicious traffic. Alert-only monitoring suits environments where blocking risks availability, not prevention.

Disabling Google Cloud Audit Logs to reduce storage overhead

Why it fails: Disabling Cloud Audit Logs removes the Admin Activity and Data Access records needed to detect privilege escalation and credential theft, defeating the audit itself. It tempts when storage cost is a concern, but logs are essential for forensic investigation and should be retained and exported.

Assigning broad primitive roles (Owner, Editor) to all project contributors

Why it fails: Primitive Owner and Editor roles grant near-unrestricted project control, enabling privilege escalation and broad credential access, directly contradicting least privilege. It tempts because it simplifies onboarding, but predefined roles should be replaced by granular IAM roles scoped to actual duties.

Sharing service account JSON keys publicly in public GitHub repositories for collaboration

Why it fails: Publishing service account JSON keys in public repositories exposes long-lived credentials, enabling immediate unauthorised access and privilege escalation. It tempts as a quick collaboration shortcut, but keys should instead be rotated, stored in Secret Manager, or replaced with workload identity federation.

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Why it fails: Storage discovery DLP examines data at rest in repositories; it cannot inspect live SIP VoIP streams, which is a network DLP capability. Network DLP would be correct where real-time interception of voice traffic for card data is required.

Intercepting local USB thumb drive file copy operations inline on endpoints

Why it fails: Storage discovery DLP scans data at rest on file shares, databases, and object stores; it does not intercept USB copy operations, which is an endpoint DLP function. Endpoint agents are the correct choice when blocking local removable-media transfers is the requirement.

Leaving the physical chassis intrusion detection switch disconnected

Why it fails: Disconnecting the chassis intrusion switch removes detection of case opening, so physical tampering goes unlogged and BIOS/UEFI modifications proceed unnoticed. It is tempting as a way to avoid nuisance alerts during servicing, and would suit a lab bench, but the stem requires controls that detect and deter physical and firmware tampering.

Configuring the boot order to prioritize booting from unverified USB flash drives first

Why it fails: Prioritising unverified USB boot directly undermines hardening, allowing anyone with physical access to load an untrusted OS and bypass disk encryption. It is tempting because USB booting legitimately supports imaging, recovery and diagnostics, so it would suit a build or repair bench rather than a locked-down corporate laptop fleet.

Disabling Trusted Platform Module (TPM) activation across all systems

Why it fails: Disabling TPM activation removes the hardware root of trust that seals BitLocker keys and detects firmware tampering, weakening the very BIOS/UEFI protection required. It is tempting because TPMs occasionally complicate imaging or cause key-recovery prompts, so disabling would suit legacy hardware lacking a usable TPM 2.0 module.

KeepAlive On and KeepAliveTimeout 5

Why it fails: KeepAlive governs TCP connection reuse and timeout, not request inspection or attack filtering. It is tempting because tuning it reduces latency and resource use, and it would be correct for performance hardening, but mitigating web threats requires modules such as ModSecurity and directives like ServerTokens.

DirectoryIndex index.php index.html

Why it fails: DirectoryIndex only sets which file Apache serves for a directory request; it performs no filtering or threat mitigation. It is tempting because it is a common hardening-adjacent tweak, and it would be correct when controlling default index files, but web attack mitigation needs ModSecurity rules and security headers.

Listen 80 without SSLVirtualHost configuration

Why it fails: Listening on port 80 without a TLS virtual host leaves all traffic in cleartext, so credentials and session cookies remain interceptable and no HSTS or certificate validation applies. It is tempting because plain HTTP listeners are the standard configuration for internal, non-sensitive static content or behind a TLS-terminating reverse proxy.

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Why it fails: TDE encrypts data at rest on disk and storage, leaving query parsing and parameter handling untouched, so injection remains possible. TDE is correctly chosen to protect data files and backups from physical theft or media loss.

TDE eliminates the need for database user access controls and role-based permissions

Why it fails: TDE protects data at rest only; authentication, authorisation and role-based permissions still govern access to decrypted data in memory. TDE is the right control when the requirement is protecting stored files and backups, not enforcing user privileges.

The Master Boot Record (MBR) partition table sectors

Why it fails: The MBR holds boot code and partition layout, not WMI artefacts, so it yields nothing about fileless execution. It is tempting because it is a classic persistence location, and it would be correct when investigating bootkits, but WMI investigations require the repository, event subscription and WMI-Activity operational logs.

The system HOSTS file in \Windows\System32\drivers\etc\

Why it fails: The HOSTS file maps hostnames to IP addresses and records no WMI activity, so it cannot evidence fileless execution. It is tempting because it is a common persistence and redirection location, and it would be correct when investigating DNS hijacking, but WMI analysis requires repository objects, event subscriptions and WMI-Activity logs.

Storing unencrypted paper backup tapes containing sensitive customer PII in unlocked office hallways

Why it fails: Storing unencrypted PII backup tapes in unlocked hallways violates Annex A controls on media handling and secure areas. It is tempting because hallway storage appears convenient, but the standard requires media to be encrypted, logged and kept in locked, access-controlled locations.

Leaving data center exterior emergency exit doors propped open for convenient cooling

Why it fails: Propping exterior emergency exit doors open defeats physical access control and breaches ISO/IEC 27001 Annex A requirements for secure areas. It is tempting as a cheap cooling workaround, but compliant data centres use dedicated environmental controls and keep emergency exits closed and alarmed.

Relying on legacy WEP shared keys for guest network isolation

Why it fails: WEP's RC4 keystream is trivially cracked, so it provides no isolation against sniffing or rogue devices. It is tempting because WEP is simple to configure on legacy guest hardware, and would only be defensible where no modern alternative exists and the network carries no sensitive traffic.

Configuring hidden SSIDs as the primary security defense

Why it fails: Hidden SSIDs provide zero cryptographic security and are easily discovered via probe requests.

Direct physical bus-sniffing attacks against hypervisor memory modules on multi-tenant hosts.

Why it fails: Bus-sniffing requires physical access to hypervisor hardware, which cloud providers prevent through isolation and tenant separation; it is not a primary breach vector. It is tempting because shared multi-tenancy raises side-channel fears, and physical attacks would be the correct concern in on-premises or colocation scenarios where hardware is directly accessible.

BIOS firmware flashing attacks against local endpoint motherboard EEPROMs.

Why it fails: BIOS firmware flashing targets local endpoint hardware, not cloud infrastructure; tenants cannot reach provider motherboards. It tempts because firmware attacks are a recognised endpoint threat, but cloud breaches arise from identity compromise, misconfigured storage and insecure APIs, not tenant-accessible BIOS manipulation.

Physical access tampering of rack-mounted server hardware within third-party data center cages.

Why it fails: Physical tampering inside data-centre cages is a provider-side facility control, not a primary cloud breach vector; customers rarely hold such access. It tempts because shared responsibility covers physical security, but cloud breaches stem from misconfigured storage, weak identity controls and exposed APIs.

Standard unencrypted public IP bindings on Azure VMs

Why it fails: Plain public IP bindings expose VM traffic unencrypted, so they cannot secure transit between on-premises datacenters and Azure Virtual Networks. They are tempting because public IPs do enable connectivity, and would suit scenarios needing only basic inbound reachability, not confidentiality.

Standard Azure Load Balancer without TLS offloading

Why it fails: A standard load balancer distributes inbound traffic and, without TLS offloading, neither encrypts nor terminates tunnels, so it cannot secure on-premises-to-Azure transit. It is tempting because load balancers sit in the connectivity path and TLS offloading is a familiar encryption feature, but that applies to application traffic, not site-to-site channels.

Unencrypted Azure Virtual Network Peering

Why it fails: Virtual network peering carries traffic over the Microsoft backbone but is unencrypted by default, so it does not satisfy the encrypted-transit requirement. It is tempting because peering is private and avoids the public internet, and would be correct where isolation from public networks, rather than encryption, is the stated security objective.

Disabling SELinux or AppArmor enforcement

Why it fails: Disabling SELinux or AppArmor removes mandatory access control confinement, widening the attack surface for local privilege escalation rather than hardening it. It is tempting because permissive mode silences denial errors during troubleshooting, and disabling enforcement is the correct fix when a policy blocks a legitimate, trusted application in a lab.

Enabling password authentication with zero minimum length in PAM

Why it fails: Password authentication with zero minimum length permits empty or trivial passwords, enabling brute-force and credential-guessing attacks that precede privilege escalation. It is tempting because disabling complexity is sometimes proposed for service accounts, and would be acceptable only where key-based authentication replaces passwords entirely.

Mounting all filesystems with read-write and suid privileges

Why it fails: Mounting filesystems read-write with suid permitted lets any user execute setuid binaries that run as root, the classic local privilege-escalation path. It is tempting because read-write mounts are needed for /home and /var, and would be correct for those directories if suid were separately disabled.

Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

Why it fails: Domain controllers placed in a DMZ expose the internal directory to internet-facing compromise and break the tiered isolation the DMZ exists to enforce. The option tempts engineers seeking low-latency authentication for DMZ hosts, but that requirement is met with read-only domain controllers inside the internal network, not the DMZ.

Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.

Why it fails: Unrestricted DMZ-to-internal initiation defeats segmentation: a compromised DMZ host could reach database servers directly. The option tempts architects wanting application traffic to flow freely, but such flows should traverse a firewall with explicit allow rules and brokered connections, not open initiation.

Automatically purchasing new zero-day exploits from underground forums

Why it fails: IDPS detection relies on signature matching, anomaly detection, and stateful protocol analysis, not exploit procurement. It tempts because threat intelligence feeds inform signatures, but buying zero-day exploits is offensive security activity, not an IDPS identification method.

Converting all network packets into analog audio signals for manual listening

Why it fails: IDPS engines compare packets against signatures and detect anomalies in protocol behaviour; audio conversion identifies nothing. It tempts because analogue signal analysis exists in radio and acoustic monitoring, but IP traffic requires signature, anomaly, or stateful protocol inspection instead.

Manually shutting down all enterprise internet circuits during off-peak hours

Why it fails: IDPS identifies malicious traffic through signature, anomaly, and stateful protocol analysis while the network runs; shutting circuits is availability denial, not detection. It tempts as an emergency containment step, but it identifies nothing and is not a detection method.

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Why it fails: Pre-release beta patches are untested and Microsoft does not recommend deploying them to domain controllers, risking domain-wide outages. It tempts administrators wanting early security coverage, and would be correct only in an isolated test ring, never production.

Manually editing the WSUS SQL database tables directly without backups

Why it fails: Directly editing WSUS SQL tables bypasses the WSUS administration console and API, risking corruption of the SUSDB schema and leaving no recovery path, which fails the healthy-maintenance requirement. It is tempting because direct SQL access genuinely helps when troubleshooting stuck approvals or reclaiming disk space, but that belongs in a supported cleanup routine, not routine maintenance.

Disabling transport layer security (TLS) for client communication to speed up scans

Why it fails: Disabling TLS exposes WSUS client traffic to interception and tampering, and modern WSUS builds require TLS 1.2. It tempts administrators chasing faster scan performance, and would be correct only when troubleshooting legacy clients that cannot negotiate current TLS versions.

Network switch spanning-tree root bridge priority metrics

Why it fails: Spanning-tree root bridge priority concerns Layer 2 loop topology, revealing nothing about whether antivirus or EDR agents are installed, running or updating on workstations. It is tempting because switch metrics are legitimate network-health artefacts, and such data would be the right evidence when auditing LAN redundancy or broadcast-storm resilience.

DNS root hint server IP address tables

Why it fails: DNS root hint tables list name-server addresses for recursion, providing no telemetry on antivirus or EDR agent status. They are tempting because DNS configuration is a genuine audit artefact, and reviewing root hints would be the right check when validating resolver reachability or diagnosing external name-resolution failures.

BGP router autonomous system number (ASN) peering configurations

Why it fails: BGP ASN peering shows inter-domain routing adjacencies, which cannot confirm endpoint agent health on workstations. It is tempting because peering configurations are valid audit artefacts for network infrastructure, and inspecting them would be correct when verifying WAN routing resilience or ISP failover rather than endpoint compliance.