Deep Battle Cards E–H
Deep Card E — Excessive Privilege vs Legitimate Abuse vs Privilege Elevation
Definition: Excessive = rights exceed job need. Legitimate abuse = valid rights used improperly. Elevation = lower rights become higher/admin through exploit/misuse.
Control direction: role redesign/least privilege vs contextual monitoring/behavior controls vs vulnerability remediation/prevention.
Scenario: salary table granted without need → Excessive; valid customer query used for mass exfiltration → Legitimate abuse; developer exploits function to become DBA → Elevation.
Common confusion: a large export can be either Excessive or Abuse. Ask whether that access should have existed at all.
Memory hook: Too much / Misused / Moved up.
Deep Card F — Active Monitoring vs Passive Monitoring vs Audit
Definition: Active detects/may interrupt now. Passive reviews periodic snapshots/trends. Audit independently evaluates evidence and compliance.
Scenario: 2 a.m. abnormal download triggers lockout = Active; weekly dashboard = Passive; auditor verifies policy evidence = Audit.
Common confusion: calling any log review an audit.
Exam trap: independence is a core formal-audit clue.
Memory hook: Active now; Passive later; Audit independently proves.
Deep Card G — Policy vs Standard vs Control/Evidence
Definition: Policy = high-level intent; Standard = specific measurable rule; Control/Procedure = implementation; Evidence/log = proof of operation.
Scenario: “Passwords must be strong” = Policy; minimum length/complexity = Standard; IAM configuration = Control; configuration/grant logs = Evidence.
Common confusion: treating a vague policy statement as executable control.
Exam trap: “everyone knows the rule” is not auditable evidence.
Memory hook: Say it → Specify it → Enforce it → Prove it.
Deep Card H — Outsourced Control vs Retained Accountability
Definition: vendor/cloud provider may operate controls, but the organization owning the data/business obligation remains accountable for protection/compliance.
Outputs: explicit shared responsibilities, chain of custody, contract/SLA, CRUD/RACI, right-to-audit, monitoring/reporting/evidence.
Scenario: cloud analytics provider processes PII → vendor implements controls; organization remains answerable and contracts for evidence/audit rights.
Common confusion: “vendor is responsible” becomes “organization is no longer accountable.”
Memory hook: Outsource the work, not the accountability.
Source boundary: DAMA-DMBOK2 Revised, Chapter 7; controlling details in database-risk, monitoring/audit, policy/standards, and outsourcing/cloud sections.