Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

An enterprise security assessment reveals that unprivileged workforce endpoints allow employees to connect unauthorized USB flash drives and execute untrusted software binaries directly from external media. Which of the following host-hardening strategies provides the MOST effective technical control to enforce peripheral hardware restrictions and prevent unauthorized program execution?

  1. Implement centralized administrative device installation policies paired with endpoint application block rules targeting removable drive locations.Answer
  2. B
    Deploy an inline stateful firewall policy that filters outbound traffic originating from network sockets on ports 80 and 443.
  3. C
    Mandate that all endpoints establish an encrypted remote-access VPN tunnel prior to reaching enterprise web applications.
  4. D
    Deploy network honeypot file shares configured to alert administrators when suspicious executable files are copied across subnets.

Answer

Implementing centralized administrative device installation policies paired with endpoint application block rules targeting removable drive locations.
The correct answer combines endpoint peripheral control policies with host-based application execution restrictions. Configuring host administrative policies to block USB mass storage class GUIDs prevents the operating system from loading drivers for unauthorized hardware. Additionally, enforcing application control policies prevents execution of binaries from removable drives, mitigating both the physical device risk and the code execution threat.

Step-by-Step Solution

1
Analyze the threat scenario described in the audit finding.
Identified two distinct attack vectors: unauthorized physical hardware mounting (USB mass storage) and local untrusted binary execution.
Effective enterprise hardening requires mitigations operating at the host OS layer where the hardware interfaces and execution calls take place.
2
Evaluate technical mitigation controls matching the identified threat vectors.
Endpoint management policies (such as Group Policy or MDM device control) restrict driver installation for removable storage device classes, and host application control rules prohibit executing binaries residing on external paths.
Combining peripheral control with execution control addresses both physical connection risks and file execution risks on the host.
3
Differentiate preventive host hardening controls from perimeter network defenses and detection technologies.
Network firewalls, VPNs, and honeypots do not prevent local file execution or local hardware mounting on isolated host OS subsystems.
Defenses must align with the specific layer of vulnerability; host security controls are required for local storage and execution threats.

Key Concept

Endpoint Device Control and Application Hardening
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic