A morphed worm carrying a 0-day payload has infiltrated the company network and is now spreading across the organization. The security administrator was able to isolate the worm communication and…

Question

Options

• ADeploy the following ACL to the HIPS: DENY - TCP - ANY - ANY ?445.
• BRun a TCP 445 port scan across the organization and patch hosts with open ports.
• CAdd the following ACL to the corporate firewall: DENY - TCP - ANY - ANY - 445.
• DForce a signature update and full system scan from the enterprise anti-virus solution.

• A
  67% (14)
• B
  5% (1)
• C
  19% (4)
• D
  10% (2)

Explanation

TCP port 445 is used by SMB (Server Message Block), which is commonly exploited by self-propagating worms (e.g., WannaCry, NotPetya). Since the worm has already infiltrated the internal network, blocking port 445 at the perimeter firewall (option C) would not stop the internal spread - the worm is already inside. A Host-based Intrusion Prevention System (HIPS) ACL deployed to each endpoint (option A) directly blocks port 445 at the host level, preventing the worm from communicating with other hosts on the internal network and stopping lateral movement. This is the most effective short-term containment measure for an already-internal threat. Option B (port scanning and patching) is too slow for an active spreading worm. Option D (antivirus signature update) may not help against a morphed worm with a 0-day payload since signatures may not yet exist for it.

No community discussion yet for this question.