Network Defense Management practice questions

ISO/IEC 27005

Why it fails: ISO/IEC 27005 provides guidelines specifically for information security risk management.

ISO/IEC 27701

Why it fails: ISO/IEC 27701 is an extension for privacy information management.

ISO/IEC 27035

Why it fails: ISO/IEC 27035 focuses exclusively on information security incident management.

Requiring uppercase, lowercase, numbers, and symbols with 90-day rotations

Why it fails: Complex composition rules combined with frequent rotations are discouraged by modern NIST guidelines.

Banning passphrases in favor of 6-character complex alphanumeric strings

Why it fails: Short passwords are easier to crack than long passphrases.

Mandating password changes every 30 days regardless of compromise

Why it fails: Frequent forced resets lead to weak, predictable password variations.

Automated patching of endpoint operating system kernels

Why it fails: Wireless authentication protocols do not patch operating systems.

Prevention of physical layer cable tapping and electromagnetic emissions

Why it fails: Wireless encryption does not protect physical layer wired cables.

Enforcement of BGP route validation and origin autonomy

Why it fails: BGP routing is unrelated to wireless LAN authentication protocols.

Public exposure of all internal router passwords on corporate websites

Why it fails: Exposing passwords violates all security and confidentiality trust principles.

Disabling all system auditing and log generation to maximize server CPU performance

Why it fails: Disabling logging prevents auditability and causes automatic audit failure.

Remediation Level (RL) of official vendor security patches

Why it fails: Remediation Level belongs to the Temporal metric group.

Exploit Code Maturity (ECM) of public exploit kits

Why it fails: Exploit Code Maturity is part of the Temporal metric group, not the Environmental metric group.

Enable private VLANs (PVLANs) on the core switches to prevent lateral movement between CDE hosts and user workstations.

Why it fails: Private VLANs restrict Layer 2 communication between hosts in the same VLAN, which can limit lateral movement. They do not, however, provide a stateful inspection point or a documented trust boundary that an assessor can use to exclude systems from CDE scope. PVLANs are also operationally complex on many campus platforms and do not inspect Layer 3 or Layer 7 traffic between the CDE and other zones.

Deploy 802.1X with EAP-TLS on all access switch ports and place CDE devices into a dedicated RADIUS-returned VLAN.

Why it fails: 802.1X with EAP-TLS authenticates devices and can return a VLAN assignment via RADIUS attributes, which is useful for access control. However, it still depends on the underlying VLAN segmentation being enforced at Layer 2, and it does not by itself create an inspectable enforcement point between the CDE and non-CDE traffic. It also requires a functioning PKI and supplicant rollout, delaying immediate scope reduction.

Configure ACLs on the existing core switches to permit only CDE-to-CDE traffic and deny all other inter-VLAN communication.

Why it fails: Static ACLs on core switches can filter traffic, but they are stateless, difficult to audit for PCI-DSS, and do not inspect application-layer protocols. They also rely on correct VLAN design that does not currently exist in the flat campus. Without a stateful enforcement point and clear documentation, an assessor is unlikely to accept the ACL as a segmentation control that reduces CDE scope.

Annualized loss expectancy

Why it fails: Annualized loss expectancy is a financial figure derived from the single loss expectancy multiplied by the annualized rate of occurrence. That calculation requires monetary estimates and frequency data, whereas the scenario describes combining likelihood and impact qualitatively or semi-quantitatively. It is a related but distinct metric, not the one described.

Control gap

Why it fails: A control gap describes the difference between required and implemented safeguards, not a likelihood-times-impact calculation. Identifying gaps is part of control assessment and feeds into risk analysis, but it is not the combined metric the analyst is deriving from threat likelihood and business impact.

Residual risk

Why it fails: Residual risk is what remains after controls have been applied, not the raw combination of likelihood and impact before treatment. The scenario describes calculating the inherent risk for an asset, and residual risk would only be determined after remediation or mitigation is in place and re-evaluated.

Conducting incident containment following a zero-day breach

Why it fails: Incident containment is reactive response activity, occurring when a breach is detected, not during the proactive Assessment and Analysis phase that establishes baseline posture. Containment would be correct within the response phase of the lifecycle, after assessment, design and implementation have already matured the defensive capability.

Deploying next-generation firewalls across core network segments

Why it fails: Assessment and Analysis establishes the current security posture through inventory, vulnerability scanning and risk identification; deploying firewalls is a remediation activity belonging to later implementation phases. Firewall deployment would be correct once gaps identified during assessment have been prioritised and funded.

Decommissioning obsolete routers and end-of-life switches

Why it fails: Decommissioning obsolete routers and switches is a remediation or lifecycle-management task performed after assessment identifies them as risks. The initial phase instead gathers asset inventory, topology and vulnerability data. Decommissioning would be correct during the implementation phase, once the assessment has documented which devices pose unacceptable exposure.

Every 30 days continuously across all internal subnets

Why it fails: Requirement 11.3 sets external penetration testing at least annually and after significant infrastructure or application changes, not monthly across internal subnets. It is tempting because continuous scanning is expected elsewhere in PCI-DSS, but that applies to internal vulnerability scans, a different control with a quarterly cadence.

Annually following the completion of the fiscal budget review

Why it fails: Requirement 11.3 ties external penetration testing to at least once every twelve months plus after significant changes, not to a fiscal budget cycle. It is tempting because annual testing is genuinely required, but the trigger is infrastructure or application change, not finance review completion.

Only upon the initial deployment of the cardholder data environment

Why it fails: PCI-DSS v4.0 requires external penetration testing at least annually and after significant infrastructure or application changes, not merely at initial deployment. It is tempting because one-off testing does satisfy some change-triggered scenarios, but the standard mandates recurring annual testing regardless of changes.

Physical Security Controls

Why it fails: Physical security controls govern facility access, badges and equipment protection, not data sharing on external platforms. It is tempting because the AUP contains a physical security section, but that section covers premises and hardware; regulating cloud collaboration requires the AUP's data handling or acceptable use clauses.

Disaster Recovery Protocols

Why it fails: Disaster recovery protocols cover restoration of systems and data after outages, not employee conduct on external platforms. It is tempting because cloud tools hold corporate data needing recovery, but regulating sharing behaviour belongs in the AUP's data handling or acceptable use provisions, which govern user actions directly.

Network Infrastructure Redundancy

Why it fails: Network infrastructure redundancy addresses resilience of links and devices, not employee data-sharing conduct. It is tempting because cloud collaboration depends on network availability, but redundancy is an engineering control; the AUP's usage provisions are what constrain how staff share data externally.

PL (Planning)

Why it fails: PL addresses security planning policy and architecture development, not the processes for managing supplier and third-party risk across the acquisition lifecycle. It tempts because supply chain governance involves forward planning, yet SR (Supply Chain Risk Management) is the family scoped to supply chain risk controls.

CA (Assessment, Authorization, and Monitoring)

Why it fails: CA covers assessing, authorising and continuously monitoring controls, not establishing supply chain risk management processes themselves. It tempts because governance implies oversight and review, yet SR (Supply Chain Risk Management) is the family scoped to supplier and third-party risk controls.

SC (System and Communications Protection)

Why it fails: SC covers protective measures for systems and communications, such as boundary protection and cryptography, not the governance processes for managing supplier risk. It tempts because supply chain attacks often exploit network pathways, but SR (Supply Chain Risk Management) is the family addressing supplier risk management directly.

BGP Routing Table Summaries

Why it fails: BGP routing tables describe network reachability between autonomous systems, containing no identity or credential data, so they cannot evidence individual accountability. It is tempting because routing artefacts are audited for network integrity, and would be correct when verifying route propagation or prefix hijacking rather than account ownership.

Network Switch Port VLAN Assignments

Why it fails: VLAN port assignments document network segmentation, not who holds which administrative credential, so they cannot evidence individual accountability. They are tempting because they do map access paths, and would be the right artefact when auditing whether sensitive subnets are isolated from general user traffic.

DNS Zone File Configurations

Why it fails: DNS zone files map names to records and hold no user identity information, so they cannot demonstrate that administrative credentials are unique. It is tempting because zone files are a standard audit artefact, and would be correct when validating record integrity, zone transfers or unauthorised DNS changes.

Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic

Why it fails: Trusting all outbound traffic leaves exfiltration and lateral movement uninspected, and stateful inspection only at the perimeter ignores the DMZ-to-application boundary. It is tempting because stateful inspection tracks connection state efficiently, and would be correct at an internet edge, but least privilege demands filtering in both directions here.

Disable firewall packet filtering on internal interfaces to maximize application throughput

Why it fails: Disabling packet filtering removes the enforcement point entirely, so no least-privilege rule set exists between DMZ and application tier. It is tempting when throughput is the priority, since filtering adds latency; however, firewalls would be the correct choice where inspection overhead genuinely threatens performance and compensating controls exist.

Permit all internal traffic by default, blocking only known malicious signatures

Why it fails: Default-permit with signature blocking inverts least privilege: any traffic not matching a known signature reaches the application tier. It is tempting because signature-based detection targets known threats with low administrative effort, and would suit an intrusion prevention layer, but not the default-deny rule structuring this tier boundary requires.

Patch Management Policy

Why it fails: A patch management policy governs vulnerability remediation cycles and software update schedules, not data classification or disposal. It would be correct when defining how and when operating system and application patches are tested and deployed.

Remote Access Policy

Why it fails: A remote access policy governs VPN, authentication and endpoint requirements for off-site connections, not data classification or disposal. It would be correct when specifying how remote users connect and what controls their devices must meet.

Firewall Configuration Policy

Why it fails: A firewall configuration policy governs rule sets, port filtering and traffic inspection, so it cannot classify data, prescribe handling procedures or define disposal methods. It is tempting because firewall policies are foundational to network security, and would be the right first draft when the requirement is controlling inbound and outbound traffic between network segments.

Syslog RFC 5424

Why it fails: Syslog RFC 5424 defines a message transport and event format, not a structured checklist schema, so it cannot express SCAP rules for evaluation. It is tempting because syslog is machine-readable and central to security monitoring, and it would be correct for forwarding audit events to a SIEM rather than authoring checklists.

CSV (Comma-Separated Values)

Why it fails: CSV is a flat file format not natively used for SCAP machine-readable evaluation rules.

SNMP MIB (Management Information Base)

Why it fails: An SNMP MIB defines managed object identifiers and their data types for network monitoring, not SCAP checklist rules, so OpenSCAP cannot parse it. It is tempting because MIBs are machine-readable and used in compliance-adjacent network management, and a MIB would be correct for polling device status via SNMP.

Isolating compromised VLANs from the core routing backbone during an active attack

Why it fails: Isolating VLANs is a containment action executed during the response phase, not governance established beforehand. It would be correct once an incident is confirmed and spread must be halted, whereas Planning and Preparation requires incident response policy, roles, and communication procedures to be defined in advance.

Restoring critical database backups from immutable offsite storage vaults

Why it fails: Restoring backups is a recovery activity performed after an incident has been contained and eradicated. It would be correct during the recovery phase to return systems to normal operation, but Planning and Preparation instead requires establishing backup governance, roles, and tested restoration procedures beforehand.

Performing root-cause analysis on active command-and-control channels

Why it fails: Root-cause analysis is a post-incident or active-investigation activity, not preparation. It would be correct after containment to determine how the breach occurred and prevent recurrence, whereas the Planning and Preparation phase demands documented governance, escalation paths, and defined responsibilities before any incident arises.

Configuration Management Baseline Drift

Why it fails: Baseline drift means a system's settings have diverged from an approved hardened configuration, which may include log settings, but the finding is a retention duration shortfall, not a configuration deviation. Baseline management would be correct when comparing deployed settings against a defined standard.

Network Redundancy Fault Tolerance Failure

Why it fails: Redundancy and fault tolerance address availability of systems and data during component failure, not the retention period of audit records. It is tempting because disk exhaustion caused the purge, but the failed control is log retention, not resilience engineering.

Access Control Discretionary Discrepancy

Why it fails: Discretionary access control concerns who may read or modify resources based on owner-assigned permissions, not how long logs persist. It is tempting because logs are data subject to access rules, yet the audit found a retention shortfall, so permissions are irrelevant here.

Packet drop rate on enterprise core firewalls

Why it fails: Packet drop rate measures operational throughput on firewall interfaces, revealing congestion or filtering behaviour, not the monetary cost of a breach. It is tempting because drops can indicate blocked attacks. Board-level financial exposure needs quantified risk, such as annualised loss expectancy derived from asset valuation and breach likelihood.

Common Vulnerability Scoring System (CVSS) base score

Why it fails: CVSS base scores rate technical severity of individual vulnerabilities, not monetary impact, so they cannot express financial exposure to a board. They are tempting because they prioritise patching effort. A quantitative risk metric such as annualised loss expectancy, combining asset value with breach probability, communicates financial exposure directly.

Active directory domain controller CPU utilization

Why it fails: Domain controller CPU utilisation is a host performance indicator, showing load or possible resource exhaustion, and carries no relationship to breach cost. It is tempting because authentication outages disrupt business. Communicating financial exposure requires quantified risk figures, such as annualised loss expectancy, calculated from asset value and breach probability.

It enforces static IP address allocation across dynamic DHCP scopes

Why it fails: Mapping logs to ATT&CK identifies adversary tactics and techniques, informing detection and response; it has no bearing on DHCP address assignment. Static allocation is configured on DHCP servers directly, so this describes an unrelated network administration task.

It compresses network packet captures to reduce storage overhead

Why it fails: ATT&CK mapping enriches and contextualises log data for detection; it does not alter packet capture storage. Compression is a function of capture tooling or storage configuration, making this the right answer only when the goal is reducing retention costs.

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Why it fails: ATT&CK mapping correlates observed activity to known adversary behaviour; it does not remediate vulnerabilities. Automated patching is performed by vulnerability or patch management tooling, which is the correct control when the requirement is closing zero-day exposure.

TFTP (Trivial File Transfer Protocol)

Why it fails: TFTP transfers files without encryption or authentication, so it cannot provide the encrypted administrative tunnel the policy demands. It is tempting because TFTP is commonly used to upload switch firmware and configurations, and would be correct for transferring image files over a trusted local network.

HTTP over port 80

Why it fails: HTTP over port 80 sends switch management commands in cleartext, so it cannot form the encrypted tunnel the policy mandates. It is tempting because HTTP is the standard for browser-based device management interfaces, and would be correct for unencrypted web administration where confidentiality is not required.

Telnet over port 23

Why it fails: Telnet over port 23 transmits credentials and commands unencrypted, failing the policy's encrypted-tunnel requirement. It is tempting because Telnet is the traditional command-line switch administration protocol, and would be correct only on isolated management networks where encryption is not mandated.