Scenario practice questions

Authentication

Why wrong: Authentication verifies identity; it is not violated by excessive file access.

Non-repudiation

Why wrong: Non-repudiation prevents denial of actions; not related to access levels.

Accountability

Why wrong: Accountability ensures actions can be traced; not directly violated by excessive permissions.

The server is down

Why wrong: If the server were down, no one would be able to access it.

The network cable is unplugged

Why wrong: A cable issue would affect the specific user, not the entire department.

The user's account is disabled

Why wrong: A disabled account would prevent access from any location.

Least privilege

Why wrong: Least privilege was not the primary missing principle.

Fail securely

Why wrong: Fail securely ensures security on failure, not relevant here.

Complete mediation

Why wrong: Complete mediation checks every access, but the issue was lack of layers.

Perform daily backups and store them offsite.

Why wrong: Daily backups stored offsite reduce the window of potential data loss to 24 hours, but the scenario’s core problem is that user files created after the backup were lost because the backup was three days old. Offsite storage does not shorten the backup interval; it only protects against physical threats like theft or fire. This option is tempting because offsite backups are a standard defence against site-level disasters, and in a scenario where the primary risk was a building fire or flood, offsite storage would be the correct choice.

Implement RAID 1 for disk redundancy.

Why wrong: Protects against disk failure but not against accidental deletion or corruption.

Enable versioning on the file server.

Why wrong: Helps recover previous versions but does not protect against hardware failure of the server itself.

Role-based access control (RBAC)

Why wrong: RBAC assigns permissions based on roles, but not dynamic rules like expense amount.

Discretionary access control (DAC)

Why wrong: DAC allows owners to set permissions, not rule-based on transaction attributes.

Mandatory access control (MAC)

Why wrong: MAC uses labels, not transaction rules.

Perform a forensic analysis of the user's workstation

Why wrong: Forensic analysis is a later step in incident response; first, the incident must be declared and the response team mobilized.

Reset the user's password and enforce multi-factor authentication

Why wrong: These are remediation steps that would follow the initial incident response actions like containment.

Disable the user account immediately

Why wrong: Disabling the account is a containment step that should be part of the incident response plan, but it is not the first process to initiate. First, the incident should be reported and triaged.

Cold site

Why wrong: Cold site is dedicated space.

Warm site

Why wrong: Warm site is also a dedicated facility.

Hot site

Why wrong: Hot site is a dedicated facility, not dependent on another organization.

Defense in depth; risk of single point of failure

Why wrong: Defense in depth involves multiple layers of control, not task segregation.

Need-to-know; risk of data exposure

Why wrong: Need-to-know limits access to data based on job necessity, not task segregation.

Least privilege; risk of excessive permissions

Why wrong: Least privilege is about granting minimum permissions, not about splitting tasks among individuals.

Privileged access management; risk of account compromise

Why wrong: PAM focuses on controlling and monitoring privileged accounts, not on dividing responsibilities.

Perform advanced forensic analysis on the affected system.

Why wrong: Advanced analysis is Tier 3 responsibility.

Conduct threat hunting to identify similar patterns.

Why wrong: Threat hunting is Tier 3 activity.

Implement a firewall rule to block all traffic from that location.

Why wrong: Implementation of changes is not a Tier 1 task.

Need-to-know

Why wrong: Need-to-know restricts data access, not task division.

Least privilege

Why wrong: Least privilege is about minimal permissions, not splitting tasks.

Job rotation

Why wrong: Job rotation moves people through roles over time.

Mandatory access control (MAC)

Why wrong: MAC uses security labels and is too restrictive for typical business environments.

Discretionary access control (DAC)

Why wrong: DAC gives resource owners discretion, which can lead to excessive privileges.

Attribute-based access control (ABAC)

Why wrong: Attribute-based access control (ABAC) evaluates access decisions against a policy engine using subject, resource, and environmental attributes, but it does not inherently enforce a baseline of least privilege tied to job roles. The stem requires a model that restricts access strictly to what is necessary for a specific role, which ABAC cannot guarantee without a pre-defined role-to-attribute mapping—a function that role-based access control (RBAC) provides natively. ABAC is tempting because it offers fine-grained, dynamic policy enforcement in complex environments, such as granting access based on time of day or location, and would be correct when access rules must adapt to changing contextual attributes rather than static job functions.

Need to know

Why wrong: Need to know restricts access to information necessary for job responsibilities, not transaction approval.

Defense in depth

Why wrong: Defense in depth involves multiple layers of security controls, not specifically dual approval.

Least privilege

Why wrong: Least privilege focuses on granting minimal access rights, not on splitting transaction approval.

Malware

Why wrong: While malware could cause this, the category is more specifically data exfiltration under unauthorized access.

Denial of service

Why wrong: DoS would involve flooding, not outbound traffic from a server.

Social engineering

Why wrong: Social engineering involves manipulating people, not technical traffic patterns.

The standby site's network connectivity was not tested

Why wrong: Network connectivity is not mentioned as an issue; the problem is access privileges.

The database replication configuration was incorrect

Why wrong: The replica exists, implying replication was functioning; the issue is inability to promote it.

The database failover procedure was not documented

Why wrong: The plan might have documentation, but the core issue is that the team lacks the necessary privileges to execute it.

Mean Time to Repair (MTTR)

Why wrong: MTTR is an average repair time metric, not a target for recovery.

Service Level Agreement (SLA)

Why wrong: SLA is a contractual agreement, not a specific recovery metric.

Recovery Point Objective (RPO)

Why wrong: RPO defines the acceptable data loss in terms of time.

Full-scale simulation without prior notification.

Why wrong: While possible, it is not a standard DR test type; often used for specific exercises.

Unit testing of individual applications.

Why wrong: Unit testing is part of software development, not DR.

Vulnerability scan.

Why wrong: Vulnerability scanning is a security assessment, not DR testing.

Non-repudiation

Why wrong: Incorrect. Non-repudiation provides cryptographic proof (e.g., digital signatures) to prevent denial of an action. While related, the scenario only requires logging identity, not cryptographic proof.

Confidentiality

Why wrong: Incorrect. Confidentiality ensures data is not disclosed to unauthorized parties, which is not described in the scenario.

Integrity

Why wrong: Incorrect. Integrity ensures data is not altered improperly. Logging changes does not directly ensure integrity, though it can help detect unauthorized modifications.

Confidentiality; encrypt the email attachments

Why wrong: Encryption protects against disclosure, not modification.

Non-repudiation; require read receipts

Why wrong: Read receipts confirm delivery, not data integrity.

Availability; use a redundant email server

Why wrong: Redundancy ensures uptime, not data integrity.

Accountability

Why wrong: Accountability tracks actions, but does not define the approval process for access.

Least privilege

Why wrong: Least privilege limits access to the minimum necessary, but does not mandate a separate approver like a data owner.

Non-repudiation

Why wrong: Non-repudiation prevents denial of actions, not access control.

Regular employees can install software on their workstations

Why wrong: Installation rights often exceed job needs.

The CEO has root access to all servers

Why wrong: Root access is excessive unless required.

All users have full control over shared folders

Why wrong: Full control violates least privilege.