Scenarios 07–12
7 — Batch account reuse
Situation: batch service ID is distributed to analysts for ad-hoc queries.
Decision: What is the problem?
Expected reasoning: service-account credentials are being used outside their approved task. Restrict account to commands/systems and tightly govern credentials.
8 — Confidential plus regulated
Situation: report contains Restricted Confidential pricing data plus PII governed by two external categories.
Decision: How are restrictions applied?
Expected reasoning: one internal confidentiality level based on the most sensitive content plus every applicable external category/action.
9 — Strong-password policy
Situation: policy says “passwords must be strong,” but teams disagree on length/complexity.
Decision: What is missing?
Expected reasoning: a Standard: specific, measurable rules that operationalize the policy.
10 — Suspicious 2 a.m. access
Situation: system should immediately alert and lock an account for abnormal-volume download at 2 a.m.
Decision: Active or Passive?
Expected reasoning: Active monitoring because the requirement is real-time detection/interruption.
11 — Trend review
Situation: security wants weekly snapshots of access patterns against normal behavior.
Decision: Active or Passive?
Expected reasoning: Passive monitoring: periodic snapshots/trend comparison.
12 — Proof of training
Situation: privacy training is required before PII access; auditor asks for proof for one employee.
Decision: What makes control auditable?
Expected reasoning: recorded evidence linking training completion to the employee before authorization; “we tell everyone to train” is not proof.