Which Security Strategy Best Addresses an Unidentified Vulnerability Breach?

312-50v12 By islever Editorial Last updated

Introduction to Ethical Hacking

Short answer

D Adopt a Continual/Adaptive Security Strategy that continuously predicts, prevents, detects, and responds to threats across the network environment.

Question

Given the complexities of an organization’s network infrastructure, a threat actor has exploited an unidentified vulnerability, leading to a major data breach. As a Certified Ethical Hacker (CEH). you are tasked with enhancing the organization's security stance. To ensure a comprehensive security defense, you recommend a certain security strategy. Which of the following best represents the strategy you would likely suggest and why?
  1. Develop an in-depth Risk Management process, involving identification, assessment, treatment, tracking, and review of risks to control the potential effects on the organization.
  2. Establish a Defense-in-Depth strategy, incorporating multiple layers of security measures to increase the complexity and decrease the likelihood of a successful attack.
  3. Implement an Information Assurance (IA) policy focusing on ensuring the integrity, availability, confidentiality, and authenticity of information systems.
  4. Adopt a Continual/Adaptive Security Strategy involving ongoing prediction, prevention, detection, and response actions to ensure comprehensive computer network defense. Correct Answer

Key Takeaways

The exam tests whether you can distinguish an ongoing adaptive security cycle from risk management, layered defense-in-depth, and information assurance; the trap is choosing defense-in-depth because it sounds comprehensive even though it lacks the continuous prediction-and-response emphasis.

This CEH 312-50v12 scenario asks which strategy provides comprehensive network defense after an unidentified vulnerability causes a major breach. The page establishes that the Continual/Adaptive Security Strategy (D) fits because it continuously predicts, prevents, detects, and responds instead of relying on a single static control model.

Common mistake: Many learners choose Defense-in-Depth (B) because multiple layers sound like the strongest response to an unknown vulnerability, but the question stresses a comprehensive continual strategy spanning prediction, prevention, detection, and response, which is the adaptive security model.

Expert Analysis

Why the Answer Is Correct

Option D is the best fit because the question calls for a comprehensive security defense after an unidentified vulnerability has already been exploited. The Continual/Adaptive Security Strategy is explicitly framed around ongoing prediction, prevention, detection, and response, which matches the need to adapt as new weaknesses emerge. Unlike a one-time control set, this model assumes the environment changes and that defenders must continuously monitor and adjust. The CEH v12 material cited by commenters reinforces this four-part adaptive security cycle.

Why the Other Options Are Wrong

Option A, Risk Management, is important for identifying, assessing, and treating risks, but it is a risk-governance lifecycle rather than the full operational defense cycle described in the scenario. Option B, Defense-in-Depth, adds layered controls and raises attacker complexity, yet layering alone does not capture the continuous prediction, prevention, detection, and response process that the question emphasizes. Option C, Information Assurance, focuses on integrity, availability, confidentiality, and authenticity, but it is a policy and assurance objective rather than a comprehensive adaptive defense strategy. None of these options matches the CEH wording as precisely as D.

Community Comment Notes

insaniunt cites the CEH v12 book and describes the adaptive model using the phrase “Protection, Detection, Responding and Prediction,” which aligns with the four-part strategy in option D. cloudgangster also points to the CEH v12 text with “It is D, pg 54 ceh v12,” while pechuga simply confirms D. smoce’s preference for B illustrates the common layered-defense trap, but the stronger support comes from the question’s explicit focus on ongoing comprehensive defense.

Exam Strategy

When a CEH question stresses an unknown vulnerability and a “comprehensive” or ongoing defense, look for the strategy that spans the full security lifecycle—prediction, prevention, detection, and response. Do not let broad-sounding terms like defense-in-depth or risk management override the wording about continual or adaptive action.

Frequently Asked Questions

Why is Defense-in-Depth (B) not the best choice after an unidentified vulnerability?

Defense-in-Depth adds layered controls, but it does not by itself define the continuous prediction, prevention, detection, and response cycle the question asks for.

Does Risk Management (A) not cover breach response?

Risk Management identifies and treats risks, but the CEH scenario emphasizes an ongoing comprehensive defense strategy rather than a risk lifecycle process.

More 312-50v12 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. insaniunt 👍 7 Answered D
    D. Organizations should adopt adaptive security strategy, which involves implementing all the four network security approaches: Protection, Detection, Responding and Prediction The adaptive security strategy consists of four security activities corresponding to each security approach - page 53 from ceh v12 book
  2. qtygbapjpesdayazko 👍 1 Answered D
    D. Adopt a Continual/Adaptive Security Strategy involving ongoing prediction, prevention, detection, and response actions to ensure comprehensive computer network defense
  3. [Removed] 👍 1
    Could someone help me confirm the accuracy of this data
  4. smoce 👍 1 Answered B
    they are in. B sounds like the best option.
  5. cloudgangster 👍 4 Answered D
    It is D, pg 54 ceh v12
Show 1 more comment
  1. pechuga 👍 1
    It is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide