The principle of least privilege dictates restricting access to only necessary sources. Limiting SSH to known corporate and developer IPs significantly reduces the attack surface while maintaining operational utility. NACLs are stateless and can be complex to manage, disabling access breaks functionality, and a host-based firewall adds management overhead without fixing the overly permissive cloud-layer rule.

Containment must be swift but controlled. A quarantined VLAN (or equivalent network segmentation) stops the spread of the ransomware to other assets while keeping the systems online for forensic analysis, memory capture, and potential decryption key retrieval. Powering down destroys volatile evidence. Simply blocking outbound traffic may not stop lateral movement, and delaying containment poses an unacceptable risk to the organization.

Modern brute-force and credential-stuffing attacks are designed to evade simple, high-velocity thresholds. They distribute attempts over time (low and slow) and across many source IP addresses. An effective detection rule must aggregate failures over a longer time window (e.g., 50 failures in 6 hours) and/or correlate failures across multiple source IPs targeting the same destination.

The core tenet of Zero Trust is “never trust, always verify.” It eliminates the assumption that anything inside the corporate network is trustworthy. Access decisions are based on identity, device health, and context for every session, not network location. The other options are specific implementations (DMZ, hardware keys) or misconceptions (network segmentation remains vital for defense-in-depth).

For a critical, public-facing vulnerability, immediate action is required. The best practice is a two-pronged approach: 1) Quickly deploy a compensating control (like a WAF rule) to mitigate the risk temporarily. 2) Initiate the organization’s emergency change process to get the official patch deployed in a controlled, documented manner. This balances speed with process adherence and reduces the window of exposure.

DNS tunneling encodes data from other protocols (like HTTP or SSH) within DNS queries and responses. It’s a common exfiltration and C2 technique because outbound DNS (UDP 53) is almost always allowed through firewalls. DGAs also create random domains, but primarily for malware to find a working C2 server, not necessarily for exfiltrating large amounts of stolen data in the query itself.

Collecting all logs without a strategy leads to ‘alert fatigue’ and data swamping. The critical first step is a log management strategy that prioritizes collection based on regulatory requirements, critical assets, and specific detection use cases. This ensures the SIEM contains relevant, actionable data. The other options address symptoms (volume, staffing, performance) but not the root cause of poor planning.

The core issue is that having software on an ‘approved’ list is not a one-time event. A robust vulnerability management program requires continuous monitoring (via tools, vendor advisories, threat intel) for new vulnerabilities in *all* software, especially internet-facing components. The attack succeeded because the process to identify and patch the vulnerable plugin failed. The other options are relevant security controls, but the root process failure is in vulnerability management.

In dynamic container environments, a service mesh is a purpose-built control plane for managing service communication. It provides rich, application-layer telemetry (who talked to whom, when, for how long, and the result), enforces policies, and enables mTLS—all crucial for security monitoring in a microservices architecture. Physical taps miss encrypted traffic and intra-host communication, static IPs are antithetical to container orchestration, and basic logging lacks the granular traffic flow context.

The principle of least privilege dictates restricting access to only necessary sources. Limiting SSH to known corporate and developer IPs significantly reduces the attack surface while maintaining operational utility. NACLs are stateless and can be complex to manage, disabling access breaks functionality, and a host-based firewall adds management overhead without fixing the overly permissive cloud-layer rule.0