Exam CIPT topic 1 question 136 discussion

A. The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts. This option best explains why the retailer's consumer data was still exfiltrated despite having malware detection software. If the detection software was in place but the alerts were not acted upon by the security personnel, the malware could have continued its operation, leading to the data breach. Effective implementation and response to alerts are crucial for preventing such breaches.

A is the answer!

How sure are we on these answers?

A is the answer because data is "still" leaked.

A is the answer

Agree A is a better answer.

B was definately not written in the question. A is better.

A is the correct answer. This case study relates to the well known Target Data Breach. It is reported in many sources that their security operations did not respond to alerts that had picked up the suspicious activity. See https://arxiv.org/pdf/1701.04940.pdf Although B is true about what happened in the case, that Department of Justice notification was after the exfiltration and does not explain best why the retailer's consumer data was still exfiltrated.

This one is confusing. All of the options are feasible in an incident situation.