Hard Difficulty Questions

Implement strict access controls and encryption for all data.

Why wrong: Technical controls alone do not address the innovation balance.

Adopt a 'security by design' approach for all new projects.

Why wrong: Important but may not provide the balance needed; too security-centric.

Create a separate innovation sandbox with limited data access.

Why wrong: May limit innovation scope and does not address governance balance.

Number of security alerts triaged per day.

Why wrong: Operational metric, not a business value indicator.

Time to patch critical vulnerabilities.

Why wrong: Technical metric, not directly showing business value.

Percentage of systems with endpoint protection installed.

Why wrong: Does not reflect business value or risk reduction.

Segment the network to isolate production databases from developer workstations.

Why wrong: Network segmentation is a technical control; the governance gap remains.

Conduct security awareness training for all developers on password security.

Why wrong: Training is insufficient; the issue is lack of governance over privileged access.

Deploy endpoint protection and patch management for all workstations.

Why wrong: Technical controls address symptoms, not the governance gap.

The vendor's service level agreements (SLAs) for incident response times.

Why wrong: SLAs are operational but governance oversight is paramount.

The vendor's technical expertise and certifications.

Why wrong: Important but not the most critical governance issue.

The cost savings compared to in-house operations.

Why wrong: Cost is important but not the most critical governance consideration.

Weak password policies

Why wrong: Weak passwords could lead to initial compromise but not specifically to undetected exfiltration.

Unpatched web server software

Why wrong: Unpatched software may be an entry vector, but DNS tunneling detection is about network monitoring.

Lack of data-at-rest encryption

Why wrong: Data-at-rest encryption protects stored data but does not detect exfiltration.

Notify the service owner

Why wrong: Notification is important but not the immediate next step.

Disable the service account

Why wrong: Disabling may disrupt services; changing password is less disruptive.

Investigate the source IP addresses

Why wrong: Investigation can follow, but immediate action is to secure the account.

Implement network segmentation for sensitive systems

Why wrong: Segmentation limits lateral movement, not initial infection.

Deploy additional antivirus software on endpoints

Why wrong: Antivirus may not detect zero-day malware.

Conduct security awareness training for all employees

Why wrong: Training reduces risk but does not fully prevent macro-based attacks.

Security awareness training for all employees.

Why wrong: Training is important but not directly a continuity integration.

Vulnerability scanning schedules.

Why wrong: Vulnerability scanning is proactive security, not continuity.

Number of security tools deployed

Why wrong: More tools do not equal maturity; could indicate complexity.

Low number of security incidents

Why wrong: May be coincidental; not a reliable maturity metric.

Notify the data protection officer and legal team.

Why wrong: Notification is necessary but should happen after containment.

Review firewall logs to confirm data exfiltration.

Why wrong: Reviewing logs is important but not immediate; containment first.

Run a full antivirus scan on the database server.

Why wrong: Antivirus scan may not detect advanced threats and delays response.

Risk of unauthorized external access to internal services.

Why wrong: The ACL permits outgoing traffic, not incoming.

Risk of denial-of-service attacks from internal hosts.

Why wrong: DoS would require specific attack vectors, not just outbound rules.

Risk of IP spoofing attacks from the inside network.

Why wrong: ACLs do not inherently allow spoofing; spoofing depends on other factors.

Accept the risk because ALE after control is only $2,500.

Why wrong: The current ALE is $10,000, not $2,500; acceptance is based on cost-benefit analysis.

Implement the control because it reduces ALE to $2,500.

Why wrong: The control cost ($12,000) exceeds the reduction in ALE ($7,500), so it is not cost-effective.

Implement the control because ALE is $10,000, and control cost is only $12,000.

Why wrong: The control cost should be compared to risk reduction ($7,500), not full ALE.

A SYN flood attack is in progress.

Why wrong: Each connection completes the handshake, so it is not a SYN flood.

A single host is using multiple IP addresses to scan the server.

Why wrong: The requests are to the same server but from different legitimate sources.

A distributed denial-of-service (DDoS) attack is occurring.

Why wrong: The traffic volume is low and appears normal; no indication of overload.

The ACL is applied to the outbound interface, which is ineffective for blocking inbound attacks.

Why wrong: The exhibit does not specify direction, but the ACL is likely applied inbound; even if outbound, the governance concern is the missing outbound filtering.

The ACL permits any traffic after denying specific IP ranges, creating a security gap.

Why wrong: The permit any any at the end is standard after denying specific ranges; it does not create a gap by itself.

The ACL permits all traffic from private IP addresses, which could allow internal IP spoofing.

Why wrong: The ACL denies private IP addresses inbound, so this is not a concern.

Risk mitigation by implementing compensating controls

Why wrong: Compensating controls are a form of mitigation, but the question says the system cannot be patched; however, compensating controls can still reduce risk. The key is that the vulnerability cannot be fixed, so mitigation may not be fully effective. The best answer is acceptance if no controls are cost-effective.

Risk transfer through cyber insurance

Why wrong: Insurance transfers financial risk but not operational risk; the vulnerability remains.

Risk avoidance by decommissioning the system

Why wrong: Decommissioning would avoid risk but is not acceptable because the system is critical.

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Why wrong: This can be excessively restrictive and reduce business agility in regions with lighter regulations.

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Why wrong: This may leave high-risk areas under-protected and does not address stricter requirements.

Allow each business unit to define its own security controls based on local requirements.

Why wrong: Without central coordination, this can lead to fragmentation and ineffective risk management.

Perform vulnerability assessments on critical systems.

Why wrong: Technical assessments are not a governance committee responsibility.

Set the organization's risk appetite.

Why wrong: Risk appetite is set by the board of directors.

Conduct daily monitoring of security events.

Why wrong: This is an operational task, not governance.

Percentage of systems compliant with security baseline.

Why wrong: Compliance does not equal effectiveness; controls may still be inadequate.

Number of security incidents reported per month.

Why wrong: This is an operational metric that does not directly indicate program effectiveness.

Mean time to detect (MTTD) security events.

Why wrong: This is a technical metric, not a strategic one for the board.

Provide additional security awareness training focused on policy requirements.

Why wrong: Training is helpful but may not be sufficient if policies are not aligned with business processes.

Escalate non-compliance to senior management for disciplinary action.

Why wrong: Disciplinary action may create resistance and does not address root causes.

Increase the frequency of automated policy compliance checks.

Why wrong: Monitoring alone does not improve compliance; it only detects non-compliance.

Publishing a public disclosure of the incident.

Why wrong: Public disclosure may be required by law, but it does not directly incorporate lessons learned.

Terminating the incident response team's engagement.

Why wrong: Termination should occur after lessons are documented, not before.

Restoring all systems to full production status.

Why wrong: Restoration is part of recovery, not the primary activity for lessons learned.