Scenario: Your organization recently switched to a new ISP, and you've noticed a significant drop in network speed. What would be the best first step to diagnose the issue?

A.  Review SLAs

B.  Conduct a penetration test

C.  Reconfigure the firewall

D.  Perform a network baseline assessment

Answer:  D

Explanation:

A. Review SLAs

A Service Level Agreement (SLA) is a contractual document that defines the expected level of service (uptime, bandwidth, latency) between the ISP and the organization.

• The Timing: You review the SLA when you have proof that the vendor is failing to meet their obligations. Without data from a baseline or current performance test, you have no leverage or evidence to present to the ISP to demand a credit or a fix.

B. Conduct a penetration test

A penetration test is an adversarial assessment designed to find exploitable security vulnerabilities.

• The Misalignment: While a botnet infection or a DDoS attack can slow down a network, a penetration test is not a troubleshooting tool for general performance. It is expensive, time-consuming, and entirely the wrong "instrument" for measuring bandwidth throughput or latency.

C. Reconfigure the firewall

The firewall is a common "chokepoint" in a network.

• The Risk: Making changes to security configurations without a known cause is a violation of Change Management best practices. If you "open up" the firewall or change its inspection settings to try and increase speed, you might inadvertently create a security hole without actually solving the underlying ISP problem.

D. Perform a network baseline assessment

A baseline is a set of measurements taken during "normal" operations that represent the standard performance level.

• Why it's the Answer: To prove that speed has "dropped," you must compare current performance metrics (utilization, latency, jitter, and throughput) against your previous baseline. This helps you determine if the bottleneck is at the ISP Gateway, an internal switch, or perhaps a misconfigured MTU (Maximum Transmission Unit) setting following the switch to the new provider.

Key Takeaway for the CISSP Exam

Baselines are used across multiple domains in the CISSP:

• Domain 4 (Network): To identify performance bottlenecks or unusual traffic patterns.

• Domain 7 (Operations): To detect anomalies in system behavior that might indicate a compromise.

• Domain 3 (Engineering): To establish "Security Baselines" (minimum required security settings) for servers and workstations.