Examkin

Soru

Zorluk: KolayMitigation Strategies and Enterprise Hardening Practices

An organization's security operations team observes that unauthorized software scripts are frequently executing from temporary user directories on endpoint workstations. To restrict hosts so that only explicitly authorized executables and scripts are permitted to run, which of the following technical mitigation controls should be implemented?

  1. Application allowlistingCevap
  2. B
    Network microsegmentation
  3. C
    Perimeter firewall packet inspection
  4. D
    Production deception honeypot deployment

Cevap

Application allowlisting is the most effective endpoint hardening control to prevent unauthorized binaries and scripts from running.
Application allowlisting (also known as application control) enforces a strict policy where only approved software, scripts, and libraries are allowed to execute. By blocking execution from unverified locations such as user temporary folders, it directly mitigates the unauthorized execution of untrusted scripts.

Adım Adım Çözüm

1
Analyze the threat vector
Identified unauthorized executable and script execution occurring on local user endpoint paths.
Understanding where and how code executes isolates host runtime policies as the core defensive boundary.
2
Evaluate mitigation technologies against the objective
Application allowlisting establishes an explicit default-deny rule set for executable binaries, scripts, and DLLs.
Allowlisting prevents unapproved applications from executing regardless of their location on the local file system.

Anahtar Kavram

Application Allowlisting and Endpoint Hardening
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru