The scenario describes a SQL injection attack. While a WAF (option B) can help detect and block such attempts, it is a detective/compensating control. The most effective preventive control is implemented at the application code level through rigorous input validation and the use of parameterized queries (or prepared statements), which ensure user input is treated as data, not executable code. This addresses the root cause of the vulnerability.

The primary goal during the containment phase of an active malware outbreak is to prevent further spread and damage. Isolating the affected systems (network segmentation/quarantine) is the critical first step to contain the threat. Forensic collection (A) is important but secondary to stopping the spread. Restoration (D) is part of recovery, which comes after containment. Notification (C) is necessary but not the immediate technical action to limit damage.

Encryption provides confidentiality by scrambling the data, making it unreadable without the key. A cryptographic hash (or better, a Hash-based Message Authentication Code – HMAC) provides integrity, allowing the recipient to verify the data has not been modified. Using only a digital signature (A) provides integrity and non-repudiation but not necessarily confidentiality. Encryption alone (B) provides confidentiality but not a verifiable mechanism for integrity. A hash alone (C) provides integrity but no confidentiality.

The core security risk of BYOD is the loss of control over the device. An unmanaged personal device may lack necessary security patches, encryption, or malware protection. Corporate data (like email) resides on a device outside the organization’s security boundary, commingling with potentially risky personal apps and data, leading to a high risk of data leakage or compromise. While the other options are concerns, they are primarily operational or HR issues, not the paramount security risk.

Defense-in-depth employs multiple, different types of controls. A firewall is a preventive control at the perimeter. An Intrusion Detection System (IDS) placed internally is a detective control that monitors network traffic for malicious activity or policy violations, serving as a separate layer to identify threats that have penetrated the outer defense. A second identical firewall (A) is not a distinct control type. Password policies (C) and backups (D) are important controls but belong to the identity and recovery layers, respectively, not as a direct secondary layer for detecting network intrusions.

When a vulnerability cannot be remediated directly (patching), but the risk cannot be avoided (application must run), the appropriate strategy is Risk Mitigation. This involves implementing a compensating control to reduce the likelihood or impact of the threat. A dedicated firewall with application-specific rules can isolate and protect the vulnerable system. Avoidance (A) is not an option per the scenario. Acceptance (C) is a last resort if no mitigation is possible. Transference (D) (insurance) may be part of the strategy but does not reduce the technical risk; it only shares the financial consequence.

While closely related and often integrated, a Disaster Recovery Plan (DRP) is primarily focused on the restoration of IT and telecommunications systems, data, and infrastructure after a disruptive event. A Business Continuity Plan (BCP) has a wider scope, encompassing the plans to sustain and recover all critical business functions (e.g., HR, facilities, supply chain, customer service) during and after a disruption. The BCP ensures the business can continue operating, not just that IT systems are restored.

The principle of Least Privilege dictates that a user or process should be granted the minimum levels of access—or permissions—necessary to perform its intended function. In this case, the junior technician should receive temporary, granular privileges sufficient only for the one-time task, not full administrative rights. This minimizes the potential damage from errors or misuse. Defense in Depth (B) is a broader strategy. Separation of Duties (C) involves splitting a sensitive process among multiple people. Need to Know (D) is related to information access, not system privileges.

For security auditing, logs must provide a complete and accurate record of events to support detection, investigation, and attribution. Critical elements include who (user ID), what (action/event), when (timestamp), and the outcome (success/failure). This detail is paramount. While protecting log integrity (hinted at in A) is important, it’s not achieved through a proprietary format. Plain text (C) is not a security requirement, and physical-only storage (D) is impractical and insufficient for modern systems.

The scenario describes a SQL injection attack. While a WAF (option B) can help detect and block such attempts, it is a detective/compensating control. The most effective preventive control is implemented at the application code level through rigorous input validation and the use of parameterized queries (or prepared statements), which ensure user input is treated as data, not executable code. This addresses the root cause of the vulnerability.0