Question

A retail organization has strong preventive controls at its network perimeter, but a recent tabletop exercise revealed that if an attacker bypasses these controls, the security team would have no reliable way to identify malicious activity occurring on internal servers. The information security manager wants to close this gap most effectively. Which control should be prioritized?

Accepted Answer

Deploy centralized log collection with security monitoring and alerting on internal systems

Answer

Add a second firewall behind the perimeter to strengthen network segmentation

Answer

Require multi-factor authentication for all internal administrative accounts

Answer

Establish a documented incident response plan with defined escalation paths