D340 Cyber Defense and Countermeasures - Set 1 - Part 3

Correct Answer: Technology deployed without organizational approval or oversight

Shadow IT comprises systems and services adopted without IT approval, creating unmanaged, unmonitored risk outside established security controls.

Correct Answer: It falls outside patching, monitoring, and access governance

Unapproved systems escape vulnerability management, logging, and access reviews, creating blind spots that attackers can exploit undetected.

Correct Answer: Mapping how data moves so trust boundaries and exposures become visible

Data flow diagrams reveal where data crosses trust boundaries, which is precisely where authentication, validation, and encryption requirements arise.

Correct Answer: A point where data passes between components with different trust levels

A trust boundary separates zones of differing trust, such as between the internet and an application. Data crossing it requires validation and authorization.

Correct Answer: Designing defenses on the premise that compromise will eventually occur

Assume breach shifts emphasis toward detection, containment, and resilience, recognizing that prevention alone will eventually fail against determined adversaries.

Correct Answer: It increases investment in detection, segmentation, and response capability

If compromise is inevitable, limiting blast radius through segmentation and detecting intrusions quickly become as important as preventing initial access.

Correct Answer: The extent of damage achievable from compromising one component

Blast radius describes how far an attacker can reach from an initial foothold. Segmentation and least privilege deliberately constrain it.

Correct Answer: Building security into a system from the beginning rather than adding it later

Security by design integrates security requirements into architecture and development from the outset, which is far more effective and cheaper than retrofitting.

Correct Answer: Architectural changes late in development are costly and often incomplete

Fundamental security properties depend on architecture. Changing architecture after implementation requires extensive rework and frequently yields partial protection.

Correct Answer: Defining measurable security properties the system must satisfy

Explicit security requirements make protection measurable and testable, ensuring security is verified rather than assumed during development and acceptance.