Hard Difficulty Questions

Delete the data

Why it fails: Deleting data may destroy forensic evidence and is not the immediate priority.

Review logs to determine access

Why it fails: While important, notification is more urgent; log review can follow.

Change the storage bucket policy

Why it fails: The bucket has already been secured; changing policy again is unnecessary.

Log all emails without any alerts

Why it fails: Logging every message without alerts produces no enforcement or notification, so a breach continues undetected and the security half of the balance is unmet. It is tempting because passive logging suits forensic auditing and baseline visibility, and would be correct where monitoring only, not prevention, is required.

Block all emails containing keywords like 'confidential'

Why it fails: Keyword blocking quarantines legitimate business mail containing 'confidential', halting workflows and generating false positives that erode productivity. It is tempting because content-based blocking is a genuine DLP control, and would be correct where strict prevention of specific regulated data patterns is the priority.

Encrypt all outgoing emails automatically

Why it fails: Encrypting all outbound mail protects data in transit but does not detect or prevent exfiltration, so the monitoring requirement is unaddressed. It is tempting because encryption is a recognised data-protection control, and would be correct where confidentiality of messages in transit is the objective rather than DLP monitoring.

Disable ICMP redirects on hosts.

Why it fails: ICMP redirects concern layer-3 routing messages, not ARP, so disabling them leaves ARP cache poisoning untouched. It is tempting because ICMP redirect manipulation is a genuine attack vector, and this hardening is correct when hosts must ignore forged redirects to prevent traffic rerouting.

Use MAC address filtering on switches.

Why it fails: MAC address filtering restricts which source MACs may use a switch port, but ARP spoofing uses the attacker's own legitimate MAC with forged IP-to-MAC mappings, so filtering does not detect it. It is tempting as a Layer 2 access control, and would be correct for limiting unknown devices on a port.

Enable STP BPDU guard.

Why it fails: BPDU guard disables a port receiving spanning-tree BPDUs, defending against rogue switches and topology loops, not ARP poisoning. It is tempting because it is a Layer 2 port-security measure, and would be correct when implementing PortFast edge ports that must never participate in STP.

Get an object from resource2

Why it fails: The policy grants read access only to resource1, so retrieving an object from resource2 is denied. It is tempting because resource-level scoping is exactly how Microsoft Entra ID conditional access and Azure RBAC assignments are targeted; had the policy's resource scope included resource2, this action would have been permitted.

List the objects in resource1

Why it fails: Listing objects in resource1 is a bucket-level operation, but the policy grants object-level permissions only, so no list action is authorised. It tempts because list permissions are commonly grouped with object reads, yet here the grant scope excludes them.

Delete an object from resource2

Why it fails: The policy grants no delete capability on resource2, so deletion is denied regardless of other permissions held. Delete is tempting because it is a distinct action from read or write, and it would be permitted only where the policy explicitly lists delete on that resource.

The condition is evaluated as OR instead of AND.

Why it fails: If OR, the time condition alone would permit access; but the condition explicitly uses AND.

The time condition is evaluated as BETWEEN 09:00 and 17:00 exclusive.

Why it fails: 10:00 is still inside 09:00-17:00 even if exclusive of endpoints.

The policy is misconfigured with effect Deny.

Why it fails: The effect is Permit, so it would allow access when conditions are met.

The routing table on the firewall does not have a return route to the Finance subnet.

Why it fails: Management VLAN can reach the server, so routing is configured correctly.

The DMZ ACL is blocking traffic from the Finance subnet because it only permits from Management subnet.

Why it fails: The DMZ ACL permits TCP/443 from any, so it does not block Finance.

An ACL applied inbound on the inside interface is blocking Finance traffic but allowing Management traffic.

Why it fails: The stem states there is no ACL on the inside interface, and even if there were, it would need to differentiate between VLANs, which is not typical.

Report to CERT/CC

Why it fails: Reporting to CERT/CC is coordination and disclosure, not containment; it neither stops the intrusion nor limits spread during active response. It is appropriate for notifying authorities about a significant vulnerability. Immediate isolation or blocking of affected systems is what halts exploitation while no patch exists.

Rebuild all affected systems

Why it fails: Rebuilding affected systems removes the malware but does not stop the zero-day from re-exploiting freshly rebuilt hosts, since no patch or mitigation exists yet; containment or isolation is needed first. Rebuild is tempting because it eradicates persistent artefacts, and it would be right once a patch or compensating control is available.

Apply a vendor patch

Why it fails: No vendor patch exists yet for a zero-day, so nothing can be applied immediately; patching becomes viable only once the vendor releases a fix. The option suits known, patched vulnerabilities. Immediate containment, such as isolation or blocking, addresses the exposure while no patch is available.

Both RTO and RPO are exceeded

Why it fails: RPO is likely met, so only RTO is exceeded.

RPO is exceeded but RTO is met

Why it fails: Recovery completes at 5 hours against a 4-hour RTO, so RTO is breached; the 1-hour backup interval satisfies the 1-hour RPO. It tempts because the hourly backups appear to guarantee the RPO, but the roll-forward time pushes total restoration past the RTO, so RTO is exceeded, not met.

Both RTO and RPO are met

Why it fails: RTO is not met because total time is 5 hours, exceeding 4 hours.

Contact law enforcement immediately.

Why it fails: Law enforcement notification follows internal containment, evidence preservation and management escalation; contacting them immediately bypasses those steps and can compromise the investigation. It is tempting because a known malicious domain suggests criminal activity, and referral is appropriate once the incident is confirmed and scoped.

Analyze the macro code in a sandbox.

Why it fails: Sandbox analysis is a later forensic examination step; immediate response requires containment actions such as isolating the workstation and blocking the malicious domain. It is tempting because macro analysis yields valuable indicators, and would be correct during the subsequent investigation phase rather than the immediate response.

Delete the phishing email from all mailboxes.

Why it fails: Deleting the email from all mailboxes destroys evidence and does not remediate the already-executed payload on the compromised workstation. It is tempting because purging a phishing message limits further clicks, and would be correct for a campaign that no recipient has yet opened.

Increase the bandwidth on the replication link by ordering a faster circuit from the ISP.

Why it fails: Adding bandwidth treats the symptom: the concurrent synchronisation job would still contend for the larger link and can saturate it again. It tempts because capacity genuinely constrains replication, but the root cause is unmanaged contention, which prioritisation or scheduling of replication traffic addresses directly.

Reschedule the next DR test to occur during a scheduled maintenance window with no other replication activity.

Why it fails: Rescheduling merely avoids the contention during one test window; the synchronisation job can still collide with a real failover, leaving the RTO unmet. It tempts because off-peak testing often succeeds, but the root cause is unmanaged replication contention, which prioritisation or job scheduling resolves permanently.

Revise the RTO for the customer database from 4 hours to 8 hours to account for current bandwidth limitations.

Why it fails: Revising the RTO to 8 hours accepts the bandwidth constraint rather than removing it, so the saturated replication link still delays failover during a real outage. RTO revision suits scenarios where recovery targets genuinely exceed achievable capability, not where a concurrent synchronisation job can be scheduled or throttled.

Risk avoidance

Why it fails: Risk avoidance means eliminating the activity or asset that creates the risk entirely, whereas firewalls and IDS mitigate likelihood while the network keeps operating. It is tempting because avoidance is correct when a process is too dangerous to run at all, such as discontinuing an insecure service.

Risk acceptance

Why it fails: Risk acceptance means acknowledging a risk and taking no mitigating action, so deploying firewalls and IDS contradicts it. It is tempting because acceptance is a legitimate response when the cost of control exceeds the potential loss, or when residual risk after other treatments is tolerable.

Risk transfer

Why it fails: Risk transfer shifts financial impact to a third party, typically through insurance or contracts; firewalls and IDS reduce likelihood instead of moving loss. It is tempting because transfer is valid when another party can absorb the consequence, such as cyber-insurance covering breach costs.

Firewalls

Why it fails: Firewalls filter traffic between zones but do not by themselves create the isolated segments; segmentation is achieved by dividing the network into VLANs or subnets, with firewalls controlling flows between them. Firewalls tempt because they enforce policy at segment boundaries.

Intrusion Detection Systems

Why it fails: Intrusion Detection Systems monitor traffic for malicious activity; they do not partition a network into isolated segments. It is tempting because IDS is a network security control often deployed alongside segmentation, and it would be the correct choice when the requirement is detecting attacks rather than dividing the network into separate zones.

Port security

Why it fails: Port security limits MAC addresses but does not prevent ARP spoofing.

MAC address filtering

Why it fails: MAC filtering is static and easily bypassed.

It is the risk that materialized.

Why it fails: Risk is the potential for loss or damage when a threat exploits a vulnerability. The unpatched vulnerability itself is not the risk; rather, it contributes to the risk. The risk materialized when the attacker exploited the vulnerability and caused harm. The vulnerability is a component of the risk, but it is not the risk itself. The risk is the combination of the threat, vulnerability, and impact.

It is the impact of the security incident.

Why it fails: Impact refers to the damage or loss resulting from a security incident, such as data loss, financial cost, or reputational harm. The unpatched vulnerability is not the impact; it is the weakness that enabled the incident. The impact here is the encrypted files and the ransom demand. The vulnerability is a contributing factor, not the consequence.

It is the threat that exploited the system.

Why it fails: A threat is any potential danger that can exploit a vulnerability to cause harm. In this scenario, the threat is the attacker or the malware, not the unpatched software. The unpatched vulnerability is a weakness that the threat exploited. Confusing the vulnerability with the threat is a common mistake, but they are distinct concepts in risk management.

Purchasing cyber insurance

Why it fails: Insurance transfers residual financial loss after an incident; it performs no safeguard, so it does not demonstrate due care. It is tempting because risk transfer is a legitimate risk-treatment option, but due care requires implementing the controls a reasonable organisation would apply.

Performing a background check on a new vendor

Why it fails: Vetting a vendor addresses third-party personnel risk, not the safeguarding of the organisation's own assets that due care describes. It is tempting because due diligence commonly includes vendor checks, but due care concerns implementing controls, such as patching and access management.

Accepting the risk of a legacy system

Why it fails: Accepting a legacy system's risk is a risk-treatment decision, not the exercise of care itself; due care demands implementing safeguards proportionate to the risk. It is tempting because documented acceptance is valid risk management, but it satisfies due diligence rather than due care.

Escalate the alert to Tier 3 for advanced analysis.

Why it fails: Escalating to Tier 3 hands off the incident without performing the immediate containment that an active, confirmed C2 beacon demands, allowing exfiltration to continue during the handover. It is tempting because Tier 3 handles advanced analysis, and would be correct when the alert requires deep forensic investigation beyond the analyst's remit.

Block the external IP address at the firewall immediately.

Why it fails: Blocking the external IP at the firewall severs one known C2 channel but leaves the compromised server running and the attacker free to use another address or channel. It is tempting because it gives immediate containment, and would be correct when the malicious infrastructure is confirmed and blocking it will not disrupt legitimate business traffic.

Reboot the server to terminate any malicious processes.

Why it fails: Rebooting terminates running processes but destroys volatile evidence such as memory-resident malware, network connections and injected code, and the implant may persist via scheduled tasks or services. It is tempting because it appears to stop the activity instantly, and would be correct only when restoring a known-clean system after evidence has been captured.

Confidentiality

Why it fails: Redundant servers and load balancing maintain service availability during failures or attacks, which is availability, not confidentiality. It is tempting because geographic distribution and traffic splitting feel like data-protection measures, yet confidentiality would require encryption and access controls on the stored data itself.

Integrity

Why it fails: Load balancing and geographic redundancy preserve uptime rather than detecting unauthorised modification of data, which is integrity. It is tempting because multiple server copies suggest data consistency, yet integrity specifically requires hashing, checksums or version controls to verify that stored records remain unaltered.

Non-repudiation

Why it fails: Non-repudiation requires cryptographic proof binding an action to a party, such as digital signatures or audit logs; redundancy and load balancing provide none. It is tempting because distributed servers generate traffic records, yet those logs prove nothing about which individual authorised a specific transaction.

Critical

Why it fails: Critical is a risk or impact rating, not a classification label; schemes typically use Public, Internal, Confidential and Restricted. It tempts because severity tiers in incident response do include Critical, so it fits that context rather than a data classification policy.

Sensitive

Why it fails: Sensitive describes a quality of data rather than a defined handling tier; standard schemes use labels such as Public, Internal, Confidential and Restricted. It tempts because sensitivity intuitively maps to protection level, but classification requires discrete, enforceable categories with assigned controls.

DNS poisoning

Why it fails: DNS poisoning corrupts resolver cache records, redirecting name lookups to a malicious IP; it does not manipulate MAC-to-IP mappings within a local subnet. It is tempting because both attacks redirect victim traffic, and DNS poisoning would be correct if the attacker altered domain resolution rather than forging ARP replies to hijack the server's IP at layer two.

MAC flooding

Why it fails: MAC flooding exhausts a switch's CAM table by flooding frames with bogus source MACs, forcing it to broadcast traffic; it does not forge ARP replies tying an attacker's MAC to a server's IP. ARP cache poisoning is the attack described here.

IP spoofing

Why it fails: IP spoofing forges the source address in IP packet headers, typically to bypass trust or hide origin, but it does not rewrite the MAC-to-IP binding in victims' ARP caches. The scenario describes ARP cache poisoning, which operates at layer 2.

DNS poisoning

Why it fails: DNS poisoning corrupts name-resolution records, so it cannot alter the MAC-to-IP mappings held in a switch's ARP cache. It is tempting because both attacks redirect traffic to an attacker-controlled destination, and DNS poisoning would be the answer if hosts were resolving a legitimate hostname to a malicious IP address.

IP spoofing

Why it fails: IP spoofing forges source IP addresses in packet headers, leaving ARP caches untouched; it is used in reflection or evasion attacks. Gratuitous ARP replies that overwrite the gateway mapping are the mechanism here, which is ARP poisoning.

MAC flooding

Why it fails: MAC flooding exhausts the switch CAM table, forcing unknown unicast flooding; it does not rewrite ARP cache entries with a rogue gateway MAC. Flooding would be correct if the symptom were broadcast storms or CAM table overflow.