Quiz: Case Studies and the Synthesis of the Book
A 28-question self-check that synthesizes the whole book through three landmark breaches. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP — because these cases are canonical exam material for supply-chain risk, ransomware/critical infrastructure, and zero-day vulnerability management. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] The SolarWinds/SUNBURST compromise is best categorized as a: A. phishing attack B. software supply-chain attack C. denial-of-service attack D. SQL injection
2. SolarWinds' malicious Orion update passed customers' integrity checks because it was: A. encrypted B. delivered over TLS C. digitally signed with SolarWinds' legitimate key D. small in size
3. [CISSP] For most SolarWinds victims, the control class that could most plausibly have detected the active backdoor was: A. signature-based antivirus B. behavioral/anomaly detection of beaconing C. a stronger password policy D. a firewall rule blocking all traffic
4. [Sec+] Colonial Pipeline's reported initial access was via: A. a zero-day in the SCADA system B. a malicious email attachment C. a legacy VPN account without MFA, using a breached password D. a compromised software update
5. The pipeline shutdown during the Colonial incident was: A. caused directly by ransomware turning valves B. a protective decision by Colonial under uncertainty C. ordered by an attacker D. a hardware failure
6. [Sec+] Log4Shell (CVE-2021-44228) was so dangerous in part because Log4j was most often present as a: A. standalone application users installed B. hardware component C. transitive (indirect) dependency D. browser plugin
7. In the days after Log4Shell's disclosure, the hardest question for most organizations was: A. how do we patch it? B. where are we even running it? C. who disclosed it? D. what is its CVSS score?
8. [CISSP] The single control that most directly turns "where do we run component X?" into a fast query is a: A. SIEM B. WAF C. software bill of materials (SBOM) D. VPN
9. A digital code signature on a software artifact guarantees: A. the artifact's source and build environment were uncompromised B. the artifact is free of vulnerabilities C. the artifact came from the key holder and was not altered after signing D. the vendor is trustworthy
10. [Sec+] "Unverified trust is an attack surface" is the transferable lesson most associated with: A. Colonial Pipeline B. SolarWinds C. Log4Shell D. none of these
11. Across all three cases, the variable that most separated organizations that fared well from those that fared poorly was: A. budget size B. number of staff C. visibility (of software, identity, and behavior) D. firewall vendor
12. [CISSP] Defense in depth was vindicated by SolarWinds because: A. it prevented the initial compromise B. it made an essentially unpreventable compromise detectable and survivable via later layers C. it eliminated all residual risk D. it replaced the need for patching
13. The §40.1 method says a "failed" control should be classified as absent, misconfigured, or: A. expensive B. outdated C. working-but-unwatched D. vendor-supplied
14. [Sec+] The most universal transferable lesson — applying to every organization that runs software written by others — is from: A. SolarWinds B. Colonial Pipeline C. Log4Shell D. all are equally universal
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
15. [Sec+] "Because nation-states compromised SolarWinds, ordinary organizations could do nothing to protect themselves."
16. "Colonial Pipeline's catastrophic impact required a sophisticated, novel initial-access technique."
17. [CISSP] "Once an organization patched the Log4j instances it could find, it had fully addressed the structural problem Log4Shell exposed."
18. "A valid digital signature on a vendor update means the update is safe to trust without further monitoring."
19. "The next major breach will most likely repeat the exact technique of SolarWinds, Colonial, or Log4Shell."
20. [Sec+] "Passing a PCI-DSS audit would have guaranteed protection against all three of these breaches."
Section 3 — Short answer (2 pts each)
21. [CISSP] Explain why SolarWinds' valid code-signing failed to protect customers, and name the concept (and chapter) that extends trust back into how an artifact was built.
22. State the §40.1 method's six steps for reading a breach, in order.
23. [Sec+] Colonial's initial access was a stale VPN account without MFA. Name the two control programs that together most directly close that gap, and one residual risk that remains even with both.
24. Pattern 5 of §40.5 says the next breach will be "different in detail, identical in shape." Choose one of the three breach shapes and describe the early-warning sign a defender would watch for in a future, unrelated incident of that shape.
25. For Log4Shell, name one visibility control, one protection control, and one detection control, and explain in one sentence why all three categories were needed.
Section 4 — Applied scenario (5 pts)
26. A trusted, recently-updated vendor agent on one of Meridian's data-center servers begins making regular outbound connections to a domain it has never contacted. (a) Which breach's shape does this match? (b) As incident commander, give your triage decision and the first three actions, and one action you deliberately do not take yet and why. (c) Name two Meridian controls (with chapters) that should limit the blast radius if this is a real compromise.
27. [Sec+] A board member asks whether Meridian could suffer a Colonial-style incident. In three or four sentences, give the honest answer this book models: name the realistic threat, the controls that reduce it (with chapters), and the residual risk you cannot eliminate.
Section 5 — Synthesis (3 pts)
28. [CISSP] Name the five recurring themes of this book, and for each, name the one anchor breach (of the three) that most vividly demonstrates it. (One-line justification per theme.)