Examkin

Question

Difficulty: EasyMitigation Strategies and Enterprise Hardening Practices

An organization wants to immediately detect unauthorized modifications made to critical system configuration files on a server. Which of the following technical controls is MOST effective for this purpose?

  1. Deploying File Integrity Monitoring (FIM) software to inspect baseline file hashes.Answer
  2. B
    Configuring network perimeter firewalls to block incoming unauthorized file transfer ports.
  3. C
    Setting up a network honeypot to trap unauthorized users attempting system changes.
  4. D
    Applying network layer encryption across all server management VLANs.

Answer

Deploying File Integrity Monitoring (FIM) software to inspect baseline file hashes.
File Integrity Monitoring (FIM) is specifically designed to monitor system and application files by comparing their current cryptographic hashes against established baseline hashes. If an unauthorized user or process modifies a protected file, FIM detects the hash mismatch and alerts security administrators immediately.

Step-by-Step Solution

1
Identify the primary requirement
The requirement is to detect unauthorized changes made directly to system files on a server.
Host security controls must be evaluated based on whether they inspect data at rest and local storage modifications.
2
Evaluate the capabilities of File Integrity Monitoring (FIM)
FIM compares current file hashes against a established cryptographic baseline.
When a file's content or metadata changes, its hash value updates, triggering an alert for unauthorized modification.

Key Concept

File Integrity Monitoring (FIM) for Host Hardening
Estimated Time:45s
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic