ISC2 CISSP Prep Online

The scenario most strongly indicates a phishing attack delivering a malicious attachment that led to compromise and data exfiltration. A control that scans attachments and detonates them in a sandbox (for example, via a secure email gateway, EDR, or similar tooling) is designed to detect and block or contain malware before a user opens it, which would most likely prevent the initial compromise. Strict file access controls help limit who can access project data, but they do not reliably prevent malware running under the project manager’s own account from stealing data the manager legitimately can access. Forwarding the message to IT only after downloading/opening does not prevent execution of malicious content. Replying to request verification can still engage the attacker and does not stop malicious code embedded in an attachment from executing if it is opened.

Minimizing attack surface means reducing the number of ways an attacker can interact with or exploit the system. The practice that most directly accomplishes this is disabling or removing unnecessary features, services, ports, and exposed endpoints, because it eliminates entry points and reduces reachable code paths. The choice mentioning "microservices" can improve isolation and limit blast radius when designed well, but it may also introduce additional APIs, service-to-service communication paths, and operational complexity, so it is not the most directly effective method for reducing attack surface. The choice about "vendor default configurations" is generally risky because defaults often enable extra functionality and are not hardened for a specific environment. The choice about relying only on "perimeter firewalls" does not reduce the application's own exposed functionality and assumes threats cannot bypass or originate inside the perimeter.

SAML is primarily used for federated authentication and single sign-on. In a typical SAML flow, an identity provider authenticates the user and then sends a signed assertion (a statement about the user’s authentication and possibly attributes) to a service provider. Because the parties have a trust relationship (often established via certificates and metadata), the service provider can accept that assertion and grant access without re-authenticating the user. The choice about encrypting all traffic confuses SAML with transport/session protection; encryption of network traffic is typically provided by TLS, while SAML focuses on exchanging authentication/authorization assertions (which may be signed and can be encrypted, but that is not its primary purpose). The choices describing spam filtering and public online directory lookups are unrelated to SAML’s role in federated identity.