D329 Networks and Security Applications - Set 5 - Part 3

Correct Answer: Ensuring data cannot be recovered from decommissioned storage

Deleted files often remain recoverable, so media must be cryptographically erased, degaussed, or physically destroyed before disposal.

Correct Answer: Deletion typically removes only the reference, leaving data recoverable

Standard deletion marks space as available without erasing contents, so forensic tools can readily recover the underlying data.

Correct Answer: Continuously monitoring, detecting, and responding to security events

A SOC provides continuous monitoring and coordinated response, combining people, process, and tooling to detect and contain incidents promptly.

Correct Answer: How long a compromise persists before being discovered

MTTD measures the interval between compromise and detection. Reducing it directly limits the damage an attacker can accomplish.

Correct Answer: The longer attackers remain undetected, the more damage and access they gain

Extended dwell time lets attackers escalate privileges, move laterally, and exfiltrate more data, so early detection materially reduces impact.

Correct Answer: A discussion-based walkthrough of response to a simulated scenario

A tabletop exercise walks stakeholders through a simulated incident to test decision-making, roles, and communication without disrupting production systems.

Correct Answer: Identifying root causes and improvements to prevent recurrence

A blameless post-incident review examines what happened and why, producing concrete improvements to controls, detection, and response procedures.

Correct Answer: People report problems honestly when they do not fear punishment

Blame drives concealment of contributing factors. A blameless approach surfaces the systemic conditions that allowed the incident, which is what must change.

Correct Answer: Meeting applicable legal, regulatory, and contractual security requirements

Compliance demonstrates adherence to external requirements. It establishes a floor rather than a ceiling, and compliant organizations can still be insecure.

Correct Answer: Standards define minimum requirements that may not address an organization's real risks

Compliance frameworks specify baseline controls assessed periodically, whereas genuine security requires continuously addressing the specific threats an organization actually faces.