Quiz: Case Studies and the Synthesis of the Book

A 28-question self-check that synthesizes the whole book through three landmark breaches. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP — because these cases are canonical exam material for supply-chain risk, ransomware/critical infrastructure, and zero-day vulnerability management. Answers and one-line explanations are at the end; try the whole quiz before checking.


Section 1 — Multiple choice (1 pt each)

1. [Sec+] The SolarWinds/SUNBURST compromise is best categorized as a: A. phishing attack B. software supply-chain attack C. denial-of-service attack D. SQL injection

2. SolarWinds' malicious Orion update passed customers' integrity checks because it was: A. encrypted B. delivered over TLS C. digitally signed with SolarWinds' legitimate key D. small in size

3. [CISSP] For most SolarWinds victims, the control class that could most plausibly have detected the active backdoor was: A. signature-based antivirus B. behavioral/anomaly detection of beaconing C. a stronger password policy D. a firewall rule blocking all traffic

4. [Sec+] Colonial Pipeline's reported initial access was via: A. a zero-day in the SCADA system B. a malicious email attachment C. a legacy VPN account without MFA, using a breached password D. a compromised software update

5. The pipeline shutdown during the Colonial incident was: A. caused directly by ransomware turning valves B. a protective decision by Colonial under uncertainty C. ordered by an attacker D. a hardware failure

6. [Sec+] Log4Shell (CVE-2021-44228) was so dangerous in part because Log4j was most often present as a: A. standalone application users installed B. hardware component C. transitive (indirect) dependency D. browser plugin

7. In the days after Log4Shell's disclosure, the hardest question for most organizations was: A. how do we patch it? B. where are we even running it? C. who disclosed it? D. what is its CVSS score?

8. [CISSP] The single control that most directly turns "where do we run component X?" into a fast query is a: A. SIEM B. WAF C. software bill of materials (SBOM) D. VPN

9. A digital code signature on a software artifact guarantees: A. the artifact's source and build environment were uncompromised B. the artifact is free of vulnerabilities C. the artifact came from the key holder and was not altered after signing D. the vendor is trustworthy

10. [Sec+] "Unverified trust is an attack surface" is the transferable lesson most associated with: A. Colonial Pipeline B. SolarWinds C. Log4Shell D. none of these

11. Across all three cases, the variable that most separated organizations that fared well from those that fared poorly was: A. budget size B. number of staff C. visibility (of software, identity, and behavior) D. firewall vendor

12. [CISSP] Defense in depth was vindicated by SolarWinds because: A. it prevented the initial compromise B. it made an essentially unpreventable compromise detectable and survivable via later layers C. it eliminated all residual risk D. it replaced the need for patching

13. The §40.1 method says a "failed" control should be classified as absent, misconfigured, or: A. expensive B. outdated C. working-but-unwatched D. vendor-supplied

14. [Sec+] The most universal transferable lesson — applying to every organization that runs software written by others — is from: A. SolarWinds B. Colonial Pipeline C. Log4Shell D. all are equally universal


Section 2 — True / False with justification (1 pt each)

For each, mark T or F and give a one-sentence reason.

15. [Sec+] "Because nation-states compromised SolarWinds, ordinary organizations could do nothing to protect themselves."

16. "Colonial Pipeline's catastrophic impact required a sophisticated, novel initial-access technique."

17. [CISSP] "Once an organization patched the Log4j instances it could find, it had fully addressed the structural problem Log4Shell exposed."

18. "A valid digital signature on a vendor update means the update is safe to trust without further monitoring."

19. "The next major breach will most likely repeat the exact technique of SolarWinds, Colonial, or Log4Shell."

20. [Sec+] "Passing a PCI-DSS audit would have guaranteed protection against all three of these breaches."


Section 3 — Short answer (2 pts each)

21. [CISSP] Explain why SolarWinds' valid code-signing failed to protect customers, and name the concept (and chapter) that extends trust back into how an artifact was built.

22. State the §40.1 method's six steps for reading a breach, in order.

23. [Sec+] Colonial's initial access was a stale VPN account without MFA. Name the two control programs that together most directly close that gap, and one residual risk that remains even with both.

24. Pattern 5 of §40.5 says the next breach will be "different in detail, identical in shape." Choose one of the three breach shapes and describe the early-warning sign a defender would watch for in a future, unrelated incident of that shape.

25. For Log4Shell, name one visibility control, one protection control, and one detection control, and explain in one sentence why all three categories were needed.


Section 4 — Applied scenario (5 pts)

26. A trusted, recently-updated vendor agent on one of Meridian's data-center servers begins making regular outbound connections to a domain it has never contacted. (a) Which breach's shape does this match? (b) As incident commander, give your triage decision and the first three actions, and one action you deliberately do not take yet and why. (c) Name two Meridian controls (with chapters) that should limit the blast radius if this is a real compromise.

27. [Sec+] A board member asks whether Meridian could suffer a Colonial-style incident. In three or four sentences, give the honest answer this book models: name the realistic threat, the controls that reduce it (with chapters), and the residual risk you cannot eliminate.


Section 5 — Synthesis (3 pts)

28. [CISSP] Name the five recurring themes of this book, and for each, name the one anchor breach (of the three) that most vividly demonstrates it. (One-line justification per theme.)


Answer Key

Click to reveal answers and explanations 1. **B** — a trojanized vendor software update is a supply-chain attack. 2. **C** — it was signed with SolarWinds' real key at the (compromised) source, so the signature was valid. 3. **B** — there were no known-bad indicators; behavioral detection of beaconing was the durable defense. 4. **C** — a legacy VPN account without MFA, password found in a breach dataset. 5. **B** — Colonial proactively shut the pipeline under uncertainty about IT→OT spread; the malware hit IT systems. 6. **C** — Log4j was usually a transitive dependency buried inside other software. 7. **B** — "where are we running it?" was the paralyzing question. 8. **C** — an SBOM with composition analysis answers it in minutes. 9. **C** — a signature proves origin (key holder) and post-signing integrity, *not* freedom from vulnerabilities or that the build was uncompromised. 10. **B** — SolarWinds: unverified trust is an attack surface. 11. **C** — visibility was the deciding variable. 12. **B** — defense in depth made an unpreventable compromise detectable and survivable. 13. **C** — working-but-unwatched. 14. **C** — Log4Shell applies to everyone running others' software (all of them). 15. **F** — most victims weren't even exploited; basic hygiene (behavioral monitoring, segmentation, least privilege) still made footholds expensive and visible. 16. **F** — initial access was a mundane, preventable missing-MFA credential compromise, not a novel technique. 17. **F** — patching the findable instances missed the structural lesson; the disease was the missing inventory/SBOM, not the specific library. 18. **F** — SolarWinds proved a validly-signed update can be malicious; trusted software must still be watched for untrusted behavior. 19. **F** — attackers don't repeat themselves; the next breach will share a *shape*, not the exact technique. 20. **F** — compliance is the floor, not the ceiling; none of these breaches resulted from failing an audit, and some victims surely passed theirs. 21. The build pipeline was compromised, so the malicious code was signed with the *legitimate* key — the signature was valid but vouched for already-poisoned code; **software provenance / SLSA** and pipeline integrity (Ch.29, 31) extend the guarantee to *how* the artifact was produced. 22. (1) assume it was stoppable; (2) reconstruct the timeline, verified vs. speculated; (3) map the kill chain; (4) identify which controls failed (absent/misconfigured/working-but-unwatched); (5) name the controls that would have changed the outcome; (6) extract the transferable lesson and ask "could this happen to us?". 23. **Multi-factor authentication** (Ch.16) on all remote access and **identity governance / JML** (Ch.18) to find and disable stale accounts; residual risk: a *currently-valid* account being phished or an insider misusing access — which is why behavioral detection/PAM (Ch.19, 22, 34) sit behind them. 24. Examples — *SolarWinds shape:* trusted internal software behaving in a new way (new outbound connections/processes). *Colonial shape:* authentication from a dormant/forgotten account, or remote access without strong MFA. *Log4Shell shape:* your own inability to quickly answer "where do we run X?" 25. *Visibility:* SBOM/SCA (know where you're exposed); *Protection:* WAF virtual-patching and egress filtering (block exploitation/callback); *Detection:* behavioral use cases (see exploitation attempts on still-unpatched systems) — needed together because the patch couldn't be everywhere instantly, so you must find, shield, AND watch. 26. (a) SolarWinds. (b) Triage as a high-severity hunt (trusted software, new behavior = the SUNBURST shape); first actions: preserve the network/endpoint evidence, scope which other hosts run the agent and show the behavior, and engage the IR lead; do *not* immediately wipe/ re-image the server (you'd destroy evidence and tip the adversary) or assume-benign and close it. (c) Segmentation (Ch.6–7, 32) limiting reach from the data center; PAM (Ch.19) and identity monitoring (Ch.15, 22, 34) limiting credential/token abuse. 27. Realistic threat: a stolen/stale credential on remote access leading to ransomware. Controls: phishing-resistant MFA (Ch.16), identity governance and orphaned-account hunting (Ch.18), PAM (Ch.19), segmentation (Ch.6–7), tested backups and the ransomware tabletop/IR plan (Ch.24). Residual risk: a single forgotten or freshly-compromised valid account — which is why identity governance is never "done." 28. (1) *Process not product* — Log4Shell (the missing inventory was a process gap, not a tool) or Colonial (the unkilled account). (2) *Attackers right once, defenders every time* — Colonial (one forgotten account sufficed). (3) *Human as weakest link and strongest asset* — Colonial (forgotten human account) / SolarWinds (a human analyst's curiosity reportedly cracked it). (4) *Defense in depth assumes each layer fails* — SolarWinds (later layers made an unpreventable compromise survivable). (5) *Compliance is the floor* — all three (compliant organizations were breached anyway). (Reasonable assignments vary; the justification is what counts.) **Topics to review by question:** missed 1–3, 10, 12, 15, 21 → §40.2; 4–5, 16, 23, 27 → §40.3; 6–9, 14, 17, 25 → §40.4; 11, 13, 19, 22, 24 → §40.1 + §40.5; 18, 20, 28 → §40.5–40.6 (themes).