200-201 Question 40
Select 2A security operations center (SOC) is investigating a potential data breach involving sensitive customer information. While analyzing the incident, the team identifies that attackers used stolen credentials to access the system and escalate privileges. Which security concepts should the SOC prioritize to prevent similar incidents in the future?
- A
Least Privilege
- B
Defense in Depth
- C
Non-repudiation
- D
Confidentiality
- E
Incident Response
Show answer and explanation
Correct answers: A, B
Explanation
In this scenario, attackers exploited stolen credentials and escalated privileges to access sensitive data. To prevent such incidents, the SOC should focus on enforcing the principle of Least Privilege, which limits users' access rights, and applying Defense in Depth to create multiple layers of security controls that can detect and block malicious activities at various stages. These concepts directly address the root causes of the breach and help mitigate similar risks in the future.
- A. Correct.
Least Privilege is essential because it ensures users only have access to the resources necessary for their job, reducing the risk of attackers misusing stolen credentials.
- B. Correct.
Defense in Depth is critical as it involves implementing multiple layers of security, making it harder for attackers to escalate privileges or move laterally within the system.
- C. Incorrect.
Non-repudiation focuses on ensuring actions or communications cannot be denied and is more relevant to accountability rather than preventing privilege escalation.
- D. Incorrect.
Confidentiality ensures data is protected from unauthorized access but does not directly address the prevention of privilege escalation or the misuse of credentials.
- E. Incorrect.
Incident Response is crucial for managing and mitigating active threats but does not directly relate to preventing unauthorized access or privilege escalation in this scenario.