A client wants to increase overall security after a recent breach. Which of the following would be best to implement? (Select two.)

Following a security breach, implementing foundational security principles is paramount. The principle of least privilege ensures that users, applications, and systems are granted only the specific access rights and permissions necessary to perform their required tasks. This drastically limits the potential damage an attacker can inflict if they compromise an account. Central policy management allows an organization to define, distribute, and enforce security policies consistently across the entire network from a single point of control. This is critical for rapidly deploying new, stronger security rules and ensuring there are no gaps in coverage, which is a common issue discovered after a breach.

B. Dynamic inventories: This provides visibility into network assets, which supports security, but it is a monitoring/management tool, not a direct security control implementation like access control.

D. Zero-touch provisioning: This is an automation method for deploying network devices to reduce manual configuration. Its primary goal is operational efficiency, not enhancing security posture.

E. Configuration drift prevention: While important, this is a more specific security practice that is often a feature or outcome of a robust central policy management system, making the latter a broader and more foundational choice.

F. Subnet range limits: This is a specific network configuration technique (e.g., DHCP scopes, ACLs) rather than a comprehensive security strategy like least privilege or central policy management.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

"Security and Privacy Controls for Information Systems and Organizations."

Page 101

Control AC-6 "Least Privilege": This control explicitly states

"The organization employs the principle of least privilege

allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks..." This directly supports implementing least privilege to enhance security.

2. National Institute of Standards and Technology (NIST) Special Publication 800-46

Revision 2

"Guide to Enterprise Telework

Remote Access

and Bring Your Own Device (BYOD) Security."

Page 3-1

Section 3.1 "Security Policy": The document emphasizes the need for a centralized policy

stating

"The organization should have a single telework security policy that is applicable to all of its telework programs... Centralizing policy management helps to ensure that the policy is consistent..." This highlights the importance of central policy management for consistent security.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). "The Protection of Information in Computer Systems." Communications of the ACM

18(7)

38-49. (A foundational academic paper on computer security).

Section I.A.3

"Principle of Least Privilege": This seminal paper defines the principle: "Every program and every user of the system should operate using the least set of privileges necessary to complete the job." This establishes least privilege as a core

time-tested security design principle.