Examkin

Soru

Zorluk: KolayMitigation Strategies and Enterprise Hardening Practices

An organization wants to immediately detect unauthorized modifications made to critical system configuration files on a server. Which of the following technical controls is MOST effective for this purpose?

  1. Deploying File Integrity Monitoring (FIM) software to inspect baseline file hashes.Cevap
  2. B
    Configuring network perimeter firewalls to block incoming unauthorized file transfer ports.
  3. C
    Setting up a network honeypot to trap unauthorized users attempting system changes.
  4. D
    Applying network layer encryption across all server management VLANs.

Cevap

Deploying File Integrity Monitoring (FIM) software to inspect baseline file hashes.
File Integrity Monitoring (FIM) is specifically designed to monitor system and application files by comparing their current cryptographic hashes against established baseline hashes. If an unauthorized user or process modifies a protected file, FIM detects the hash mismatch and alerts security administrators immediately.

Adım Adım Çözüm

1
Identify the primary requirement
The requirement is to detect unauthorized changes made directly to system files on a server.
Host security controls must be evaluated based on whether they inspect data at rest and local storage modifications.
2
Evaluate the capabilities of File Integrity Monitoring (FIM)
FIM compares current file hashes against a established cryptographic baseline.
When a file's content or metadata changes, its hash value updates, triggering an alert for unauthorized modification.

Anahtar Kavram

File Integrity Monitoring (FIM) for Host Hardening
Tahmini Süre:45s
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru