As a Network Security Analyst, you notice a massive spike in outbound HTTPS traffic originating from an R&D engineering workstation (192.168.10.45). Upon investigating the firewall logs and IDS alerts, you determine the traffic is destined for a consumer-grade cloud storage application (e.g., Personal Dropbox).
When you interview the engineer, they state: "The general IT policy just says 'protect data.' It doesn't explicitly forbid using this cloud service to back up my scripts. I wasn't sure, so I just used what was easiest."
Your perimeter defenses (Next-Gen Firewall, DLP) did not automatically block this connection because no explicit administrative directive exists to configure an Application Control drop rule for this specific service category.
An employee is exfiltrating (intentionally or unintentionally) 4.2GB of data via an encrypted TCP/443 session to an unsanctioned cloud storage provider. The IDS flagged the volumetric anomaly, but the firewall permitted the traffic because no Layer 7 Application Control rule was built to block it.
This is a "Shadow IT" and Data Exfiltration scenario. The root cause of the technical failure is a governance failure: without a specific policy prohibiting personal cloud storage, security teams cannot justify implementing strict firewall blocks, leading to "ambiguity" for both end-users and network defenders.
An Issue-Specific Security Policy (ISSP) focuses on a specific area of concern (e.g., Use of Cloud Storage, BYOD, Email Acceptable Use). It provides detailed directives that remove ambiguity for employees ("Can I use this app?") and gives network defenders the exact mandate needed to configure firewall drop rules, Proxy blocks, and DLP signatures.
A & B (User/IT Policy): These are usually broad, overarching documents (Enterprise Information Security Policies) that lack the granular detail needed to instruct specific firewall or endpoint configurations.
D (Group Policy): Group Policy (GPO) is a technical configuration mechanism within Microsoft Active Directory used to enforce settings on endpoints, not a written administrative document that dictates overall posture and eliminates ambiguity.
Management must draft an ISSP regarding "Approved Cloud Storage." Once published, the Network Defense team translates this into technical controls: configuring the Next-Gen Firewall to block unauthorized cloud applications via Application Control, decrypting necessary SSL traffic, and updating DLP rules to prevent sensitive file signatures from leaving the network.
Explore more CND simulations to sharpen your network defense skills.
Access Full Practice Tests Here