CAS-001 · Question #191
The security administrator is receiving numerous alerts from the internal IDS of a possible Conficker infection spreading through the network via the Windows file sharing services. Given the size of…
The correct answer is D. Call an emergency change management meeting to ensure the ACL will not impact core business functions. Even in a security emergency, blocking file sharing services across 20,000+ workstations and 1,000 servers could severely disrupt core business functions such as departmental file access, backups, and application dependencies. Change management - even an emergency meeting…
Question
The security administrator is receiving numerous alerts from the internal IDS of a possible Conficker infection spreading through the network via the Windows file sharing services. Given the size of the company which deploys over 20,000 workstations and 1,000 servers, the security engineer believes that the best course of action is to block the file sharing service across the organization by placing ACLs on the internal routers. Which of the following should the security administrator do before applying the ACL?
Options
- AQuickly research best practices with respect to stopping Conficker infections and implement the
- BConsult with the rest of the security team and get approval on the solution by all the team members
- CApply the ACL immediately since this is an emergency that could lead to a widespread data compromise.
- DCall an emergency change management meeting to ensure the ACL will not impact core business functions.
How the community answered
(43 responses)- A16% (7)
- B2% (1)
- C9% (4)
- D72% (31)
Explanation
Even in a security emergency, blocking file sharing services across 20,000+ workstations and 1,000 servers could severely disrupt core business functions such as departmental file access, backups, and application dependencies. Change management - even an emergency meeting - ensures the proposed ACL is reviewed for unintended consequences before implementation. Option A lacks the structured approval needed. Option B requires full team consensus, which is slower than an emergency meeting focused specifically on business impact. Option C skips all process controls and risks creating an outage worse than the infection. Change management is not about slowing response; it is about ensuring the remediation does not cause more damage than the threat.
Topics
Community Discussion
No community discussion yet for this question.