CAS-002 · Question #617
News outlets are beginning to report on a number of retail establishments that are experiencing payment card data breaches. The data exfiltration is enabled by malware on a compromised computer…
The correct answer is B. Implement an application whitelist at all levels of the organization. Application whitelisting blocks all unauthorized executables from running, making it the most effective defense against novel or unrecognized POS malware that evades signature-based detection.
Question
News outlets are beginning to report on a number of retail establishments that are experiencing payment card data breaches. The data exfiltration is enabled by malware on a compromised computer. After the initial exploit network mapping and fingerprinting occurs in preparation for further exploitation. Which of the following is the MOST effective solution to protect against unrecognized malware infections, reduce detection time, and minimize any damage that might be done?
Options
- ARemove local admin permissions from all users and change anti-virus to a cloud aware,
- BImplement an application whitelist at all levels of the organization.
- CDeploy a network based heuristic IDS, configure all layer 3 switches to feed data to the IDS
- DUpdate router configuration to pass all network traffic through a new proxy server with
How the community answered
(21 responses)- A24% (5)
- B57% (12)
- C10% (2)
- D10% (2)
Why each option
Application whitelisting blocks all unauthorized executables from running, making it the most effective defense against novel or unrecognized POS malware that evades signature-based detection.
Removing admin rights and switching to cloud-aware antivirus reduces attack surface but still depends on behavioral or signature detection, which may fail against zero-day or custom POS malware.
An application whitelist enforces a strict allow-list of approved executables at the host level, preventing any unrecognized or unsigned malware from running regardless of whether it has a known signature. This stops the initial payload execution and eliminates the subsequent network mapping and fingerprinting phase, directly addressing all three requirements - protection, reduced detection time, and minimized damage.
A heuristic network IDS detects anomalous traffic only after execution has already occurred, meaning it cannot prevent the initial malware infection or stop subsequent internal reconnaissance.
Routing traffic through a proxy inspects outbound communications but does not prevent malware from executing on the compromised endpoint or stop internal network mapping activity.
Concept tested: Application whitelisting to block unknown malware execution
Source: https://csrc.nist.gov/pubs/sp/800/167/final
Topics
Community Discussion
No community discussion yet for this question.