🛡️ PHC Interview Preparation Guide

Your organisation has just deployed a new Oracle 19c database cluster in production that hosts sensitive customer data. It has never been through the PHC onboarding process. The DBA team says they are very busy and are concerned that hardening changes might break their application. You need to onboard it within 60 days.

• Engages DBA team as a partner, not an enforcer — acknowledges their workload
• Correctly identifies CIS Oracle 19c benchmark as the appropriate standard
• Proposes a phased approach: scan first, then remediate Level 1 controls incrementally
• Suggests running the first scan in read-only mode to minimise risk
• Plans a baseline scan → gap analysis → remediation priority list → evidence report
• Identifies that compensating controls may be needed for application-conflicting controls

The Linux infrastructure team comes to you saying that Qualys is reporting 40 critical hardening failures on their server fleet, but they believe most of them are false positives because they use a custom SELinux configuration that achieves the same security outcome differently.

• Does not accept or reject the claim without independent validation
• Runs manual audit commands from the CIS benchmark to verify each disputed control
• Requests configuration exports, command output screenshots, and documentation
• For confirmed false positives: logs evidence and updates scan exclusions with approval
• For confirmed failures: works with team on remediation plan with agreed timelines
• Adjusts compliance report to show corrected score with explanation note for stakeholders

Your CISO informs you that an ISO 27001 external audit is scheduled in 30 days. The auditors will specifically examine hardening compliance controls across Windows servers and AWS cloud. Your current compliance scores are Windows: 78% and AWS: 65%.

• Prioritises quick-win controls that can be remediated in under 2 weeks
• Focuses on controls with highest risk rating and broadest impact first
• Prepares evidence package: scan reports, exception register, remediation tickets, policy documents
• Creates a pre-audit gap briefing for the CISO with RAG status and risk narrative
• Identifies controls where exceptions are pre-approved and ensures documentation is complete
• Sets realistic expectations — communicates the target score and remaining gaps transparently

Wiz flags a critical finding: an S3 bucket in your AWS production account has public read access enabled and contains what appears to be configuration files. The Wiz alert is marked Critical. The cloud platform team says it was intentional for a web application but did not go through change management.

• Immediately escalates to the Cloud Security team and CISO as a potential data exposure
• Confirms whether the bucket actually contains sensitive data before acting
• Understands the business purpose before revoking access — avoids breaking production
• Works with Cloud team to restrict access via bucket policy while preserving the web app function
• Documents incident in deviation register and initiates a post-incident review
• Recommends: SCP to block public bucket creation, AWS Config rule to detect public buckets, IaC pipeline checks

You present the monthly compliance dashboard and the overall score has dropped from 82% to 74% in one month. The CISO asks: "What happened? Why are we going backwards? Is this a breach risk?"

• Does not panic or become defensive — approaches it analytically
• Checks if new assets were onboarded (increased scope = lower initial score, not regression)
• Checks if tool coverage improved (more controls now assessed = more findings visible)
• If genuine degradation: identifies which platform/control category drove the drop
• Clearly communicates whether this is a measurement/coverage change or real configuration drift
• Provides a recovery plan with timeline, owners, and expected score trajectory

Your deviation register shows 35 open exceptions, of which 18 have been open for more than 60 days. Several platform owners have stopped responding to emails. Audit is in 3 months.

• Classifies deviations by risk level — critical/high first, lower risk later
• Sends a formal written notice to platform owners with a deadline (not just email reminders)
• Escalates to platform owner's manager after two failed contact attempts with evidence
• Engages CISO or Security Director for high-risk deviations with no owner response
• Considers risk acceptance closure for low-risk items where remediation is impractical
• Reports the backlog transparently with aging analysis, owner accountability, and escalation actions taken

Your organisation is considering replacing its current configuration compliance tool with a newer platform. You are asked to lead the evaluation between two tools. You have 6 weeks and a shortlist of 2 vendors.

• Defines evaluation criteria upfront: coverage (OS/cloud/DB/network), scan accuracy, scalability, integration, reporting
• Runs a proof-of-concept on a representative sample of each platform type
• Compares CIS benchmark coverage, false positive rates, and scan performance
• Involves platform owners, security architects, and procurement in the evaluation
• Documents findings in a structured comparison matrix
• Presents a recommendation with evidence, trade-offs, migration plan, and cost analysis