Welcome to the second Scenario Clinic!
Every scenario here is written in the style of the ISC2 exams: the CC (Certified in Cybersecurity) and the CISSP.
If you're preparing for one of them, this is exactly the kind of question you'll face. If you're not, it's still the fastest way to train how security professionals make decisions.
This week, the scenarios are based on three free articles:
How to use this clinic:
Read all three scenarios.
Write down your answer for each one before scrolling.
Then check the explanations. The wrong options matter as much as the right one.
Scenario 1: The phishing problem
CC Domain 3: Identity and Access Management
Your company has been hit by three credential phishing campaigns in six months. Employees enter their username, password and SMS code on fake login pages, and attackers use them within minutes. Management wants a control that stops stolen credentials from working, even when an employee falls for the fake page.
What is the BEST control?
A) Run monthly phishing awareness training for all employees
B) Replace SMS codes with phishing-resistant authentication, such as passkeys or FIDO2 security keys
C) Require passwords of at least 16 characters
D) Block access to all websites registered in the last 30 days
