Select Two (Multi-Select) Questions

Recovery time objective.

The recovery time objective defines the maximum tolerable downtime for a business process, directly satisfying the BIA's need to quantify impact over time. It links process criticality to recovery priorities, which is why it counts as a key BIA component rather than a purely technical recovery metric.

Criticality analysis.

Criticality analysis ranks business functions by the impact of their disruption, directly satisfying the BIA's need to identify which processes and resources are most essential. It feeds recovery time objectives and recovery point objectives, ensuring continuity planning prioritises the systems whose failure would most severely affect the organisation's operations and obligations.

A communication plan with contact information for key stakeholders

A communication plan with stakeholder contact details satisfies the coordination constraint during preparation, ensuring the right people are reachable the moment an incident is declared. Without predefined escalation paths and contacts, response stalls while responders hunt for decision-makers, delaying containment and violating the plan's requirement for clear internal and external notification procedures.

Detailed recovery procedures for each critical system

Documented recovery procedures per critical system let responders restore services in a defined, tested order rather than improvising under pressure. This satisfies the preparation-phase requirement for pre-approved restoration steps that minimise downtime and data loss.

Number of unpatched critical vulnerabilities

A high number indicates higher risk of exploitation.

Percentage of systems with antivirus disabled

High percentage indicates increased malware risk.

CCTV

CCTV is a physical security control because it monitors and records the tangible environment, deterring and detecting intrusions at a facility. It satisfies the scenario's requirement for controls operating on physical premises rather than logical access.

Biometric reader

A biometric reader is a physical security control because it is a tangible device that authenticates identity through fingerprint, iris or facial characteristics, physically gating access to a facility or room. It satisfies the stem's requirement for a physical control, unlike logical or administrative measures.

Encrypt sensitive data both at rest and in transit

Encrypting sensitive data at rest and in transit renders intercepted or exfiltrated content unreadable, acting as a DLP control that limits exposure even when other safeguards fail. This satisfies the requirement to protect sensitive data across both storage and transmission states.

Deploy endpoint DLP agents to monitor and block unauthorized data transfers

Endpoint DLP agents inspect data in use on the device, intercepting transfers to USB storage, email, or cloud uploads and blocking those matching policy. This directly satisfies the requirement to prevent unauthorised data movement at the endpoint, the last point where sensitive data can leave the organisation's control.

Classify data based on sensitivity and apply appropriate labels

Labelling data by sensitivity underpins DLP enforcement: classification metadata lets policies identify which content warrants protection and apply handling restrictions. Without accurate labels, monitoring and blocking rules cannot distinguish sensitive records from ordinary files, so this control satisfies the need to define what must be protected.

Access control policies

Access control policies are administrative controls because they define rules, responsibilities and expected behaviour through documented management direction rather than technical enforcement. They satisfy the stem's requirement for administrative examples, unlike logical controls such as firewalls or physical controls such as locks.

Security awareness training

Security awareness training is an administrative control because it governs human behaviour through policy, education and procedure rather than technical enforcement. It satisfies the stem's requirement for administrative examples, unlike logical or physical controls such as firewalls, encryption or locks.

Post-implementation review

A post-implementation review closes the change management lifecycle by verifying the change achieved its intended outcome and identifying any unanticipated effects. It is a recognised procedural step, distinct from implementation itself, and satisfies the stem's requirement for a valid change process stage.

Impact assessment

Impact assessment evaluates the risk, scope and resource implications of a proposed change before approval, feeding the change advisory board's decision. It is a distinct procedural step in change management, satisfying the stem's requirement for a valid process stage.

Change request submission

Change request submission formally initiates the change management process, documenting the proposed alteration for review and approval. It is the recognised entry point step, distinct from assessment and review, satisfying the stem's requirement for a valid process stage.

IMAPS

IMAPS wraps IMAP within TLS, encrypting mail retrieval between client and server on port 993. This protects credentials and message content in transit, satisfying the requirement to secure email communication against interception during mailbox access.

SMTPS

SMTPS tunnels SMTP over TLS, encrypting message submission and relay between mail servers or clients on port 465. This protects email content in transit, satisfying the requirement to secure email communication against eavesdropping during transmission.

JavaScript execution in the browser's developer console that was not initiated by the user

XSS payloads often execute script automatically.

Presence of script tags in the page source that are not part of the original application

Injected script tags are a hallmark of XSS.

Unexpected pop-up windows in the browser

XSS can inject JavaScript that creates pop-ups.

Write-once storage to prevent modification

Write-once storage prevents logs from being altered or deleted after capture, preserving evidential integrity. This directly satisfies the forensic requirement that records remain tamper-evident and unmodified, ensuring investigators can trust that what they review reflects the original event data.

Digital signing of logs to verify authenticity

Digital signing lets investigators verify that logs originated from the claimed source and were not forged or altered in transit. This satisfies the authenticity requirement, complementing integrity controls by proving provenance, which is essential when log evidence must withstand scrutiny.

Ensuring logs are retained for a period consistent with legal and regulatory requirements

Retention aligned to legal and regulatory requirements preserves logs long enough for forensic reconstruction and satisfies chain-of-custody and evidentiary obligations. Without adequate retention, evidence may be destroyed before an investigation concludes, undermining both admissibility and the SIEM's investigative usefulness.

Trojan horse

A Trojan horse is malware disguised as legitimate software, which the user willingly executes, granting the attacker a foothold. It is a distinct malware category defined by deception rather than self-replication, satisfying the question's requirement for a common malware type.

Virus

A virus is malicious code that attaches to a host file and replicates when that file is executed, requiring user action or a triggering program. This self-replicating, host-dependent behaviour defines it as a common malware category.

Worm

A worm is standalone malware that self-replicates and spreads across networks without a host file or user interaction, exploiting vulnerabilities directly. This autonomous propagation distinguishes it from viruses and satisfies the requirement for a common malware type.

Perform a full system scan with updated antivirus on the restored system.

Scanning the restored system with current antivirus signatures detects any residual malware or dormant payloads that survived restoration, satisfying the requirement to prevent reinfection. Because ransomware often leaves droppers or secondary implants, this verification step confirms the restored host is genuinely clean before returning it to production.

Remove persistence mechanisms from the registry and startup folders.

Removing registry run keys, startup folder entries and scheduled tasks eliminates the persistence mechanisms that let ransomware relaunch after reboot, directly satisfying the reinfection-prevention requirement. Restoration alone does not clear these autostart hooks, so the malware would re-execute and re-encrypt the recovered system.

Patch the vulnerability that was exploited in the initial compromise.

Patching the exploited vulnerability closes the initial access vector, satisfying the requirement to prevent reinfection during recovery. Without remediation, the same flaw allows re-exploitation and repeat compromise of the restored environment, so patching must accompany restoration before systems return to service.

Network segmentation

Network segmentation divides the internal network into isolated zones, limiting lateral movement when an insider or compromised host attempts to reach other systems. This constrains internal threats by enforcing boundaries, directly satisfying the requirement for an effective control against internal network threats.

Employee security awareness training

Employee security awareness training educates staff to recognise phishing, social engineering and policy violations, reducing the human factor behind many internal threats. It is an administrative control that directly addresses insider risk, satisfying the requirement for an effective control against internal network threats.

Data loss prevention (DLP)

DLP inspects data flows and blocks exfiltration attempts, addressing the insider threat vector where authorised users misuse legitimate access. It enforces content- and context-based policies at endpoints, network egress and cloud channels, satisfying the stem's requirement for an effective internal threat control.

Least privilege

Holding two mutually exclusive roles grants access beyond what either role alone requires for the user's duties. Least privilege is violated because the accumulated permissions exceed the minimum necessary to perform the assigned job function.

Separation of duties

Assigning one user to two mutually exclusive roles breaches separation of duties, which requires splitting critical tasks so no single person controls an entire process end to end. The conflicting role combination grants excessive, unchecked privileges, directly violating the stem's mutual-exclusivity constraint and enabling fraud or error without detection.

Using WPA2-Enterprise with 802.1X

Provides strong authentication and encryption.

Disabling SSID broadcast

Hides the network name from casual scans.

No write-up

Subjects cannot write to higher integrity levels.

No read-down

Subjects cannot read from lower integrity levels.

Disable SSID broadcast

Hiding the SSID reduces casual detection.

Enable WPA3-Enterprise

WPA3-Enterprise uses 802.1X for strong authentication.

Implement rogue AP detection

Detecting unauthorized access points prevents security breaches.

Implement key escrow to allow recovery of encrypted data.

Key escrow stores a protected copy of decryption keys with a trusted third party or secure repository. If the original key is lost or an administrator departs, encrypted data remains recoverable, satisfying the enterprise requirement for continuity of access to encrypted information.

Rotate keys on a regular schedule or upon compromise.

Regular rotation limits the data exposed if a key is compromised, and immediate rotation after compromise restores confidentiality. This satisfies the enterprise key-management requirement by bounding each key's cryptoperiod, a core control in standards such as NIST SP 800-57.

Store keys in a hardware security module (HSM).

An HSM provides tamper-resistant hardware that generates, stores and processes keys without exposing them to host memory or disk, satisfying the requirement to protect keys at rest and in use. Software keystores leave keys extractable, so an HSM enforces the enterprise key-protection best practice.

Recognizing phishing emails

Recognising phishing emails is a core security awareness topic, teaching staff to identify suspicious senders, links and requests. It directly reduces credential theft and malware risk, satisfying the question's requirement for a valid awareness training subject.

Physical security best practices (e.g., locking screens)

Physical security best practices, such as locking screens and securing devices, form a recognised awareness training topic. Teaching these controls reduces unauthorised access and tailgating, satisfying the question's requirement for a valid security awareness subject.

Social engineering tactics

Social engineering tactics are a core security awareness topic because they teach staff to recognise manipulation attempts such as phishing, pretexting and tailgating. This directly satisfies the stem's requirement for awareness training content, addressing the human element that technical controls cannot fully mitigate.

Network traffic capture

PCAP files preserve network evidence.

RAM dump

Memory dump captures volatile evidence.

Hard drive image

A forensic image preserves the exact state of the drive.