D340 Cyber Defense and Countermeasures - Set 4 - Part 3

Correct Answer: The organization has limited visibility and control over the compromised party

When a supplier is compromised, the affected organization depends on the supplier's transparency and remediation while bearing much of the consequence.

Correct Answer: Their controls, incident history, and contractual security commitments

Vendor risk assessment examines actual security controls, certifications, breach history, and contractual obligations including notification and audit rights.

Correct Answer: Financial losses arising from cyber incidents subject to policy terms

Cyber insurance transfers defined financial risk such as response costs, business interruption, and liability, subject to policy conditions and exclusions.

Correct Answer: Failure to maintain security controls stated in the application

Policies commonly require specified controls such as MFA and backups. Misrepresenting or failing to maintain them can void coverage when a claim arises.

Correct Answer: Delays in reaching decision makers directly extend incident impact

Incidents often occur outside business hours. Current contact information for decision makers, technical staff, and external parties prevents costly delays.

Correct Answer: Skills, personnel, and environments change continuously

Staff turnover, system changes, and skill decay erode readiness, so periodic realistic exercises maintain genuine capability rather than documented intent.

Correct Answer: Inadequate preparation including missing logs, unclear roles, and untested plans

Response typically falters due to missing telemetry, undefined roles, and plans never exercised, all of which are preparation failures rather than technology gaps.

Correct Answer: Comprehensive, centralized, and retained logging

Investigation depends entirely on available evidence. Without comprehensive retained logs, responders cannot determine scope, root cause, or whether eradication succeeded.

Correct Answer: Better preparation generally reduces incident duration, scope, and total cost

Organizations with tested plans, good telemetry, and trained responders consistently detect and contain incidents faster, substantially reducing overall impact and cost.

Correct Answer: Documenting the timeline, impact, root cause, and improvement actions

An after-action report captures what happened, when, how it was resolved, the root cause, and the specific improvements assigned, creating an accountable record and organizational learning.