Information Technology and Security practice questions

Recovery time objective (RTO)

Why it fails: RTO is a business continuity metric, not a direct FAIR factor.

Cost of cyber insurance premium

Why it fails: Insurance premium is a financial transfer, not a risk quantification factor.

Number of affected systems

Why it fails: Number of systems influences loss magnitude, but frequency is also needed.

Detect

Why it fails: Detect is about monitoring and detection, not direct risk assessment.

Recover

Why it fails: Recover is business continuity, not risk assessment.

Respond

Why it fails: Respond is incident response, not risk assessment.

Model bias leading to unfair outcomes

Why it fails: Bias is important but explainability is often a regulatory requirement for automated decisions.

Data privacy during model training

Why it fails: Data privacy is important but explainability is more directly tied to credit decision regulations.

Adversarial attacks on the model

Why it fails: Adversarial attacks are a security risk but not the most critical for regulatory compliance.

Risk of unclear shared responsibility

Why it fails: Shared responsibility is a separate issue.

Risk of vendor lock-in

Why it fails: Vendor lock-in is not related to multi-tenancy isolation.

Risk of data sovereignty violations

Why it fails: Data sovereignty is about legal jurisdiction.

Selecting the technology vendor for the solution

Why it fails: Vendor selection is typically done by procurement, not ARB.

Ensuring the solution aligns with the enterprise IT strategy

Why it fails: Strategic alignment is important, but the ARB's specific risk role is reviewing security risks.

Approving the project budget and timeline

Why it fails: Budget and timeline are project management responsibilities, not ARB.

Coverage scope

Why it fails: Coverage scope defines what is covered, not premium factors.

Incident prerequisites

Why it fails: Prerequisites are conditions for coverage, not premium determinants.

Exclusions

Why it fails: Exclusions are items not covered, not premium factors.

Reduce energy consumption through efficient IT operations

Why it fails: NERC CIP mandates cybersecurity controls protecting bulk electric system assets; energy efficiency is an environmental and cost objective outside its scope. It is tempting because utilities do pursue consumption reduction through IT and OT optimisation, and sustainability reporting often sits alongside compliance programmes, making the two easy to conflate.

Ensure interoperability between different vendors' SCADA systems

Why it fails: NERC CIP addresses cybersecurity of the bulk electric system, covering asset identification, electronic security perimeters and personnel risk assessment; vendor interoperability is a separate concern handled by protocol and architecture standards. Interoperability is tempting because SCADA environments genuinely depend on multi-vendor integration, so it appears relevant to grid operations.

Standardize industrial control protocols

Why it fails: NERC CIP sets mandatory cybersecurity requirements for bulk electric system assets; protocol standardisation is the domain of bodies such as IEC and IEEE, not the reliability standards. It is tempting because consistent industrial protocols genuinely simplify securing control systems, so standardisation looks like a plausible compliance goal.

Risk register

Why it fails: The register itself is the output; the deficiency is in the process.

Risk assessment methodology

Why it fails: Methodology defines how to assess risk, not necessarily update frequency.

Risk treatment process

Why it fails: Treatment process focuses on mitigation, not register updates.

Energy consumption of cloud data centers

Why it fails: Data centre energy consumption is a sustainability and operational-cost concern, not an information risk the ARB prioritises for critical financial applications. It would be relevant to environmental reporting, but the review should focus on data residency, tenant isolation and regulatory compliance exposures introduced by the migration.

Network bandwidth limitations

Why it fails: Bandwidth is a capacity and performance concern, not one of the three risk domains the ARB must prioritise when migrating critical applications to a public cloud. It would be the right focus during network sizing or WAN capacity planning, where throughput and latency baselines are established.

Threat intelligence reports on ransomware gangs

Why it fails: Threat intelligence reports provide input to FAIR's threat capability assessment but are not the key component for calculating ALE.

Vulnerability severity scores (CVSS)

Why it fails: Vulnerability severity scores (CVSS) inform the vulnerability factor in FAIR but are not the direct component for ALE calculation.

Historical loss data from industry benchmarks

Why it fails: Historical loss data can be used to estimate loss magnitude but is not the primary factor in FAIR's ALE formula.

Increased need for IT support staff

Why it fails: Staffing is a resource issue, not a security risk.

Higher bandwidth consumption on OT networks

Why it fails: Bandwidth is a performance concern.

Loss of real-time visibility for operators

Why it fails: Visibility loss is an operational issue, not a top security risk.

Regular third-party security audits

Why it fails: Audits demonstrate good risk management, often reducing premium.

Comprehensive security awareness training for all employees

Why it fails: Training reduces risk and may lower premium.

Implementation of multi-factor authentication across all systems

Why it fails: Multi-factor authentication reduces risk, lowering premium.

Data privacy in AI training

Why it fails: Data privacy is about protecting training data, not decision explainability.

Vendor lock-in

Why it fails: Vendor lock-in is a procurement risk, not AI-specific.

Adversarial attacks

Why it fails: Adversarial attacks manipulate inputs, not directly addressed by explainability.

Response planning

Why it fails: Response planning belongs to the Respond function, covering response activities and communications during incidents. It is tempting because planning sounds preparatory and therefore identification-like, but Identify addresses asset, risk and governance understanding; response planning assumes that understanding already exists.

Recovery plan implementation

Why it fails: Recovery plan implementation sits in the Recover function, restoring services after disruption. It is tempting because recovery planning is a recognised risk treatment, but Identify requires understanding assets, risks and dependencies beforehand; executing recovery plans happens only once an incident has already occurred.

Anomalies and events detection

Why it fails: Anomalies and events detection belongs to the Detect function, covering continuous monitoring and detection processes. It is tempting because detection feels foundational to cybersecurity risk management, but Identify concerns asset management, risk assessment and governance — detection occurs after identification has established what exists.

Threat intelligence feed

Why it fails: Threat intelligence informs LEF but is not a component itself.

Control effectiveness score

Why it fails: Control effectiveness influences LEF but is not a primary component.

Vulnerability severity score

Why it fails: Vulnerability severity is a factor, not a primary component in FAIR.

The gateway may log sensitive data in plaintext, including access tokens, which could be exposed in log files.

Why it fails: Logging sensitive data is a risk, but it is a general logging practice issue rather than an OAuth 2.0-specific risk. While important, it is not the most critical risk directly tied to OAuth 2.0 implementation. The primary OAuth 2.0 risk is improper token scope and lifetime management, which can lead to broader unauthorized access.

The gateway may not validate the 'aud' (audience) claim in the access token, allowing tokens intended for other services to be replayed.

Why it fails: Validating the audience claim is important to prevent token replay across services. However, this is a specific implementation flaw that can be mitigated with proper validation. It is a significant risk, but excessive token scopes and lifetimes have a broader impact and are more commonly overlooked. The audience claim risk is narrower in scope compared to the potential for privilege escalation.

The API gateway may not support mutual TLS (mTLS) for client authentication, allowing unauthorized clients to connect.

Why it fails: While mTLS is a strong authentication mechanism, OAuth 2.0 itself provides token-based authorization. The absence of mTLS is a risk, but it is not specific to OAuth 2.0 implementation. The scenario focuses on OAuth 2.0, and the most critical risk relates to token configuration. mTLS is an additional layer that may be used, but it is not the primary concern for OAuth 2.0 authorization.

Mandatory peer code review before merging pull requests.

Why it fails: Peer review is valuable for logic and design flaws but is not reliable for detecting known vulnerable dependencies or configuration errors at scale. In a fast CI/CD pipeline, manual review cannot consistently catch the breadth of security issues that automated tooling can, and it may become a bottleneck that teams bypass.

Static application security testing (SAST) integrated into the pipeline as a quality gate.

Why it fails: SAST analyzes source code for security flaws and is a strong control, but it does not detect vulnerabilities in third-party dependencies or runtime misconfigurations. It also can produce false positives that slow deployments. Alone, it leaves a gap for the most common exploitable issues in modern applications.

Annual secure coding training for all developers.

Why it fails: Training improves developer awareness but does not provide a repeatable, automated check within the pipeline. It cannot enforce policy or catch newly disclosed vulnerabilities in dependencies. As a standalone control, it is too slow and inconsistent to prevent vulnerable code from being deployed in a rapid CI/CD environment.

The organization will lose up to 24 hours of data, exceeding the RPO.

Why it fails: With daily differential backups, the maximum data loss would be up to 24 hours if a failure occurs just before the next differential backup. However, in this scenario, the failure occurs 3 hours after the last differential, so the loss is only 3 hours, which is within the 4-hour RPO. This option misidentifies the actual data loss window and incorrectly states it exceeds the RPO.

The organization will lose all data since the last full backup because differential backups cannot be restored without the full backup.

Why it fails: Differential backups are designed to be restored along with the last full backup. They do not require transaction logs. The statement that all data since the last full backup is lost is false; only data since the last differential is lost. This option misunderstands how differential backups work and exaggerates the data loss.

The organization will lose up to 4 hours of data, exactly meeting the RPO.

Why it fails: The data loss window is determined by the time since the last backup, not by the RPO itself. The last differential was 3 hours ago, so the loss is 3 hours, not 4. Assuming the RPO is exactly met is incorrect because the actual loss is less. This option confuses the RPO target with the actual recovery point achieved.

Implement a formal risk assessment process at least annually.

Why it fails: While PCI DSS does require an annual risk assessment (Requirement 12.2), it is a broader program management requirement rather than a specific technical control directly protecting cardholder data in the application. The question asks for core requirements that directly apply to securing the web application; firewall and encryption are more directly technical and immediate. The risk assessment is important but not a direct technical safeguard.

Restrict physical access to cardholder data.

Why it fails: PCI DSS Requirement 9 does require restricting physical access to cardholder data, but in a cloud-hosted web application scenario, physical access controls are typically the responsibility of the cloud provider. The organization's direct responsibility is more focused on logical controls. While still part of PCI DSS, it is less directly applicable to the web application itself compared to network and transmission controls.

Develop and maintain secure systems and applications.

Why it fails: PCI DSS Requirement 6 is indeed a core requirement, but the question asks for TWO requirements that directly apply. Requirement 6 is broad and encompasses secure development, patching, and coding practices. While important, the two most directly applicable to protecting cardholder data in a web application are firewall configuration and encryption of transmission, as they address immediate network and data protection.

Reduced network performance due to backhauling traffic to a central location.

Why it fails: SD-WAN is designed to improve performance by intelligently routing traffic and avoiding backhaul. Reduced performance is a benefit of not backhauling, not a risk. The actual risk is that direct internet access can expose branch offices to threats without the benefit of centralized security controls that were previously enforced at the data center.

Inability to prioritize real-time traffic such as voice over IP.

Why it fails: SD-WAN excels at application-aware routing and quality of service, often improving VoIP prioritization. The inability to prioritize is not a typical risk; rather, the risk is that security controls may not keep pace with the dynamic routing. The two most significant risks are the loss of centralized inspection and inconsistent policy enforcement across diverse links.

Increased complexity of managing encryption keys across branches.

Why it fails: While key management is a consideration, SD-WAN solutions typically centralize encryption key management and automate IPsec tunnels. The complexity is manageable with proper tooling. The more significant risk is the architectural shift that removes centralized security inspection, which can leave branch traffic unprotected and create blind spots for the security team.