Mitigation Techniques

Question 1 of 6

A software vendor releases an emergency patch on a Wednesday for a critical unauthenticated remote code execution vulnerability that is actively being exploited in the wild. An organization's standard patch process requires two weeks of lab testing followed by deployment in the next scheduled maintenance window (Sunday). The CISO asks the security team to assess whether to follow the normal process. Which approach is MOST appropriate?

Follow the standard two-week testing process to ensure application stability — deploying an untested patch risks breaking production systems. Deploy the patch using an expedited emergency process with compressed testing — for an actively exploited critical RCE vulnerability, the risk of remaining unpatched exceeds the risk of deploying without full testing. Wait for the next Patch Tuesday cycle — vendor patches are always bundled monthly to reduce deployment complexity. Apply the patch only to internet-facing systems and skip internal systems until the next maintenance window, since attackers cannot directly reach internal servers.

Question 2 of 6

An employee's laptop is reported stolen from an airport. The laptop has BitLocker full disk encryption enabled with a TPM-bound key. The organization's security team is assessing whether a data breach notification is required. Which statement BEST describes the security impact?

A breach notification is required because the laptop contains sensitive data, regardless of encryption status. The theft is a hardware loss only — BitLocker encrypts the entire volume and the TPM-bound key is unavailable to the thief when the drive is removed and connected to another machine. The data is computationally inaccessible, so no breach notification is required. The data may be accessible if the thief knows the employee's Windows login password, because BitLocker decrypts automatically when the correct password is entered on any machine. BitLocker only protects files in the Documents folder — other files on the drive are accessible to anyone who connects the drive to another computer.

Question 3 of 6

A security analyst is investigating a suspected intrusion. They find that the Windows Event Log on the suspected compromised workstation shows no entries for a 4-hour period during which the attack is believed to have occurred. The analyst is trying to determine whether the attacker deleted the logs. Which mitigation provides the BEST evidence of what occurred during that period?

The host-based firewall logs stored locally on the workstation — these are stored in a separate location and are unaffected by Windows Event Log clearing. The SIEM, which ingested and stored the workstation's event logs remotely in near real time — the attacker's local log deletion does not affect the SIEM copy, and the log-clear event itself (Windows Event ID 1102) may appear in the SIEM as a separate indicator. The Windows Volume Shadow Copy service, which automatically backs up the Event Log every 30 minutes to a separate folder on the same drive. The antivirus software logs, which maintain an independent record of all system activity regardless of Windows Event Log status.

Question 4 of 6

A user's workstation account is compromised through a phishing attack. The user's account runs with local administrator privileges. The attacker uses the compromised session to install a keylogger, disable the endpoint detection software, and establish persistent access via a scheduled task. If the user's account had been a standard (non-administrator) account, which of these actions would the attacker have been UNABLE to perform?

None — a compromised account provides full access to all system resources regardless of privilege level. Installing software in user-accessible directories only — a standard account can still install drivers, modify system services, and disable security software. All three — installing a kernel-level keylogger, disabling endpoint detection software (a system service), and creating a scheduled task with SYSTEM-level persistence all require administrative privileges. A standard account cannot perform any of these actions. Disabling the endpoint detection software only — keylogger installation and scheduled task creation are available to standard accounts.

Question 5 of 6

An employee returns from a three-week vacation and connects their laptop to the corporate network. The Network Access Control system immediately restricts the laptop to a quarantine VLAN. From the quarantine VLAN, the employee can access only the Windows Update server, the EDR update server, and the remediation portal. Which of the following BEST explains why the laptop was quarantined?

The employee's account was locked due to inactivity while they were on vacation, and the quarantine VLAN is used while IT reactivates the account. The laptop failed one or more posture assessment checks — most likely the OS patch level or EDR signature currency — because it was offline for three weeks and missed scheduled updates. The quarantine VLAN provides access only to remediation resources until the device meets the compliance baseline. The quarantine VLAN is applied to all devices connecting from conference rooms as a default policy regardless of the device's security state. The laptop's IP address conflicted with another device on the network, and the quarantine VLAN is used for IP conflict resolution.

Question 6 of 6

An organization is decommissioning 200 SSDs that were used in workstations with BitLocker full disk encryption enabled from the time of deployment. The IT team asks which sanitization method is appropriate. Which is MOST appropriate for these SSDs?

Standard Windows format — this clears all data and is sufficient for media that contained only internally generated content. NIST SP 800-88 multi-pass overwrite — running a tool that overwrites every sector with random data multiple times is the gold standard for SSD sanitization. Cryptographic erase — destroy the BitLocker encryption key. Since the drives were encrypted from day one, all stored data is ciphertext; destroying the key renders all ciphertext permanently irrecoverable without overwriting any sectors. This is the correct approach for SSDs where multi-pass overwrite is unreliable due to wear leveling. Delete all user profile folders and run a single-pass zero-fill on each drive — this is sufficient because SSDs have no track-based storage structure that retains deleted data.

Matching — Mitigation Technique Concepts

Match each term on the left to its correct description on the right.

1. Full Disk Encryption

2. Cryptographic Erase

3. Quarantine VLAN

4. SIEM

1. 2. 3. 4.

A. A security platform that ingests logs from all network sensors, normalizes formats, correlates events across sources to detect multi-stage attack patterns, and stores log data remotely so that an attacker's deletion of local logs does not destroy the audit trail

B. Encryption of an entire storage volume — operating system, applications, and user data — so that a drive removed from its host computer and connected to another machine presents only unreadable ciphertext, protecting against physical theft

C. A restricted network segment that gives non-compliant devices access only to update and remediation servers — not production systems — so they can achieve compliance before being admitted to the organizational network

D. A data sanitization method that destroys the encryption key used to protect a full-disk-encrypted drive, rendering all stored ciphertext permanently irrecoverable — the preferred method for SSDs because sector overwrite is unreliable due to wear leveling

Mitigation Techniques Quiz

Matching — Mitigation Technique Concepts