Which Security Strategy Best Addresses an Unidentified Vulnerability Breach?
Given the complexities of an organization’s network infrastructure, a threat actor has exploited an unidentified vulnerability, leading to a major data breach. As a Certified Ethical Hacker (CEH). you are tasked with enhancing the organization's security stance. To ensure a comprehensive security defense, you recommend a certain security strategy. Which of the following best represents the strategy you would likely suggest and why?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can distinguish an ongoing adaptive security cycle from risk management, layered defense-in-depth, and information assurance; the trap is choosing defense-in-depth because it sounds comprehensive even though it lacks the continuous prediction-and-response emphasis.
This CEH 312-50v12 scenario asks which strategy provides comprehensive network defense after an unidentified vulnerability causes a major breach. The page establishes that the Continual/Adaptive Security Strategy (D) fits because it continuously predicts, prevents, detects, and responds instead of relying on a single static control model.
Many learners choose Defense-in-Depth (B) because multiple layers sound like the strongest response to an unknown vulnerability, but the question stresses a comprehensive continual strategy spanning prediction, prevention, detection, and response, which is the adaptive security model.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D is the best fit because the question calls for a comprehensive security defense after an unidentified vulnerability has already been exploited. The Continual/Adaptive Security Strategy is explicitly framed around ongoing prediction, prevention, detection, and response, which matches the need to adapt as new weaknesses emerge. Unlike a one-time control set, this model assumes the environment changes and that defenders must continuously monitor and adjust. The CEH v12 material cited by commenters reinforces this four-part adaptive security cycle.Why the Other Options Are Wrong
Option A, Risk Management, is important for identifying, assessing, and treating risks, but it is a risk-governance lifecycle rather than the full operational defense cycle described in the scenario. Option B, Defense-in-Depth, adds layered controls and raises attacker complexity, yet layering alone does not capture the continuous prediction, prevention, detection, and response process that the question emphasizes. Option C, Information Assurance, focuses on integrity, availability, confidentiality, and authenticity, but it is a policy and assurance objective rather than a comprehensive adaptive defense strategy. None of these options matches the CEH wording as precisely as D.Community Comment Notes
insaniunt cites the CEH v12 book and describes the adaptive model using the phrase “Protection, Detection, Responding and Prediction,” which aligns with the four-part strategy in option D. cloudgangster also points to the CEH v12 text with “It is D, pg 54 ceh v12,” while pechuga simply confirms D. smoce’s preference for B illustrates the common layered-defense trap, but the stronger support comes from the question’s explicit focus on ongoing comprehensive defense.Exam Strategy
When a CEH question stresses an unknown vulnerability and a “comprehensive” or ongoing defense, look for the strategy that spans the full security lifecycle—prediction, prevention, detection, and response. Do not let broad-sounding terms like defense-in-depth or risk management override the wording about continual or adaptive action.
Frequently Asked Questions
Why is Defense-in-Depth (B) not the best choice after an unidentified vulnerability?
Defense-in-Depth adds layered controls, but it does not by itself define the continuous prediction, prevention, detection, and response cycle the question asks for.
Does Risk Management (A) not cover breach response?
Risk Management identifies and treats risks, but the CEH scenario emphasizes an ongoing comprehensive defense strategy rather than a risk lifecycle process.