ITPEC FE Subject B April 2025 Question 19

The scenario describes a website administrator who accidentally uploaded internal documents (marked "For Internal Use") to the public directory instead of the intended public catalog files.

Blank A — preventive control:
Company V already has a watermark system that marks all internal files with "For Internal Use." The root cause was that a watermarked internal file was uploaded to the public directory. The most targeted fix is an automated tool to prevent the upload of files containing a watermark with "For Internal Use" to the website's public directory — this leverages the existing watermark system to enforce the rule automatically.

• •Options a–c (checking all upload destinations) are too broad — they restrict all uploads to public directories, not just internal files.
• •Options d–f (credential scanner) are irrelevant — the text explicitly states no credentials were exposed.

Blank B — detective control:
The phrase "to quickly detect issues" signals a need for after-the-fact detection. Periodic checks of the files in the public directory to identify any files that may be mistakenly exposed serve this purpose.

• •A dual-administrator config review policy (options g, d, a) addresses configuration changes, not detecting exposed files.
• •Monitoring for unauthorized access (options h, e, b) is irrelevant — the upload was done by an authorized administrator.

Why not others:
- (a) A is too broad; B is about config policy, not file detection
- (b) A is too broad; B monitors unauthorized access (not the issue)
- (c) A is too broad; B fits but A is not the best match
- (d) A scans for credentials (not the issue); B is config policy
- (e) A scans for credentials; B monitors unauthorized access
- (f) A scans for credentials; B fits but A does not
- (g) A fits; B is config policy, not file detection
- (h) A fits; B monitors unauthorized access (not the issue)

Key rule: leverage existing controls — if internal files are already watermarked, use that watermark as an automated filter to prevent public exposure.

AI-generated — may contain errors