Examkin

Question

Difficulty: EasyMitigation Strategies and Enterprise Hardening Practices

An organization's security operations team observes that unauthorized software scripts are frequently executing from temporary user directories on endpoint workstations. To restrict hosts so that only explicitly authorized executables and scripts are permitted to run, which of the following technical mitigation controls should be implemented?

  1. Application allowlistingAnswer
  2. B
    Network microsegmentation
  3. C
    Perimeter firewall packet inspection
  4. D
    Production deception honeypot deployment

Answer

Application allowlisting is the most effective endpoint hardening control to prevent unauthorized binaries and scripts from running.
Application allowlisting (also known as application control) enforces a strict policy where only approved software, scripts, and libraries are allowed to execute. By blocking execution from unverified locations such as user temporary folders, it directly mitigates the unauthorized execution of untrusted scripts.

Step-by-Step Solution

1
Analyze the threat vector
Identified unauthorized executable and script execution occurring on local user endpoint paths.
Understanding where and how code executes isolates host runtime policies as the core defensive boundary.
2
Evaluate mitigation technologies against the objective
Application allowlisting establishes an explicit default-deny rule set for executable binaries, scripts, and DLLs.
Allowlisting prevents unapproved applications from executing regardless of their location on the local file system.

Key Concept

Application Allowlisting and Endpoint Hardening
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic