While the unencrypted traffic is a risk, abruptly disconnecting critical operational devices (A) could cause significant disruption. Merely documenting it (B) leaves the vulnerability exposed. Immediate replacement (D) is often impractical and costly. The most balanced, immediate action is to contain the risk by forcing the traffic through an encrypted channel like a VPN, which mitigates the eavesdropping threat without causing operational downtime.

WPA3-SAE is the current generation Wi-Fi security standard. It provides stronger encryption (192-bit suite in enterprise mode, robust 128-bit in personal) and, crucially, protects against offline dictionary attacks through its handshake, a significant improvement over WPA2. WPA2-AES (A) is still secure but is the previous standard. WEP (C) and WPA-TKIP (D) are obsolete and cryptographically broken.

The principle of least privilege means users and systems should have only the minimum levels of access necessary to perform their functions. The bank teller analogy directly reflects this: the teller needs access to their drawer to function, but granting access to the entire vault is excessive and risky. While B describes default-deny (a related network security principle), C describes multi-factor authentication, and D describes auditing, none directly capture the essence of minimal access rights.

The primary goal of Containment is to limit the scope and impact of an incident. It’s a short-term, tactical action taken to stop the bleeding—such as isolating a network segment or disabling a compromised account—before moving to longer-term phases like Eradication (A) and Recovery (D). Evidence collection (B) is part of the overall process but is not the defining purpose of containment.

A SOC 2 Type II report is an independent, rigorous audit performed by a certified CPA firm. It provides detailed testing and opinion on the design and operating effectiveness of a vendor’s security controls (among others) over a period of time. This is formal, evidence-based assurance. A marketing brochure (A) is not evidence, verbal assurance (C) is informal and unverifiable, and a software list (D) does not speak to how controls are managed or their effectiveness.

Using a company VPN encrypts all traffic between the employee’s device and the corporate network, including the webmail session and the email transmission itself, regardless of the public Wi-Fi’s security. Email client TLS (B) only encrypts the connection to the mail server; the report may still traverse internal mail relays unencrypted or the webmail session might be HTTP. Option A is not a technical control, and C is highly inefficient and not a standard electronic transmission method.

The primary purpose of an HSM is to provide a hardened, tamper-evident, and often tamper-responsive physical device to safeguard cryptographic keys. The keys are generated, stored, and used inside the HSM’s secure boundary and never exist in plaintext in the host system’s memory. While HSMs can be fast (A), that’s not their primary security advantage. They complicate backup (B) by design, and key lifecycle management (D) is still required.

This option combines several powerful social engineering elements: spoofing a legitimate authority (IT Support), creating a false urgency (expiration in 2 hours), and prompting immediate action (clicking the link). This pressure tactic is designed to short-circuit rational analysis. While B and D are also social engineering (scareware and tech support scams), the email from a trusted internal source using urgency is a quintessential and highly effective phishing example in corporate environments.

The core security benefit is accountability and auditability. If multiple admins log in directly as ‘root’, all actions are attributed to the shared root account, making it impossible to determine who made a specific change. Forcing login with individual accounts and using `sudo` logs the user’s identity alongside the command executed. While it may be a PCI requirement (D), that’s a compliance outcome, not the fundamental security reason. It does not inherently improve performance (A) or simplify the process (C).

While the unencrypted traffic is a risk, abruptly disconnecting critical operational devices (A) could cause significant disruption. Merely documenting it (B) leaves the vulnerability exposed. Immediate replacement (D) is often impractical and costly. The most balanced, immediate action is to contain the risk by forcing the traffic through an encrypted channel like a VPN, which mitigates the eavesdropping threat without causing operational downtime.0