The correct answer prioritizes fixing the root cause. While a WAF is a valuable compensating control, it should not be relied upon to mitigate known, critical vulnerabilities in the code itself. The principle of secure design requires vulnerabilities to be remediated at the source. Delaying deployment to fix the code aligns with best practices for risk management and software security.

Before any external communication or detailed remediation, an accurate impact assessment is crucial. You cannot effectively communicate with customers, regulators, or law enforcement without understanding what data was involved, how many individuals are affected, and the potential business impact. This assessment directly informs the content of notifications, regulatory reporting requirements, and the subsequent remediation strategy.

While security groups and NACLs are fundamental cloud networking controls, host-based firewalls for micro-segmentation offer greater granularity and can incorporate identity (like instance IDs or tags) rather than just IP addresses. This approach aligns with the Zero Trust principle of “never trust, always verify,” even within the internal network, and is more resilient to IP address changes than traditional IP-based rules.

Professional security practice requires validation, especially when business impact is high and false positives are suspected. Blindly trusting a scanner or ignoring a critical alert are both irresponsible. The correct approach is to perform due diligence—a controlled, urgent test to determine the actual risk—before deciding on a potentially disruptive remediation action. This balances security rigor with operational stability.

A rooted or jailbroken device bypasses the manufacturer’s built-in security controls (like sandboxing), making it significantly more vulnerable to malware and compromise. This directly threatens the confidentiality and integrity of any corporate data accessed from the device. While the other options are relevant to policy, prohibiting root/jailbreak is a foundational technical control for mobile device security in a BYOD program.

Multi-factor authentication (MFA) is the definitive control for mitigating the risk of stolen credentials. Even if a password is phished, the attacker would lack the second factor (like a code from an authenticator app or a hardware token), preventing access. While password policies and training are important layered defenses, they are not foolproof. A CASB is for monitoring and policy enforcement after authentication occurs.

Attacks against application logic (like business logic flaws, injection attacks, or broken access control) manifest in the interactions between the user and the application. The web and application server logs (showing URLs, parameters, payloads, session IDs, and error codes) are the primary source of evidence for these attacks. Perimeter logs lack application context, database logs show symptoms later in the attack chain, and client-side logging is often not feasible or relevant for server-side attacks.

Inherent risk is the raw, unmitigated level of risk associated with an activity or asset in the absence of any security controls. It is a baseline measurement used to evaluate the effectiveness of existing or proposed controls. Residual risk is the risk remaining after controls are applied. The other options describe aspects of current state risk or threat modeling, not the specific definition of inherent risk.

While an NDA covers confidentiality, and an SLA covers performance, a comprehensive Cybersecurity Addendum (often part of the MSA) is specifically designed to detail security requirements, roles, and responsibilities. It mandates the vendor’s security controls, defines incident reporting timelines and methods, and grants the customer the right to audit or review security assessments, forming the contractual backbone of third-party security governance.

The correct answer prioritizes fixing the root cause. While a WAF is a valuable compensating control, it should not be relied upon to mitigate known, critical vulnerabilities in the code itself. The principle of secure design requires vulnerabilities to be remediated at the source. Delaying deployment to fix the code aligns with best practices for risk management and software security.0