CAS-002 · Question #831
Company policy requires that all company laptops meet the following baseline requirements: Software requirements: Antivirus Anti-malware Anti-spyware Log monitoring Full-disk encryption Terminal…
The correct answer is D. Remove administrative access to local users G. Restrict/disable USB access. A bootkit on Ann's laptop was spreading via removable media and exploiting local admin privileges to persist. Restricting USB access removes the primary infection vector, and removing admin rights prevents the bootkit from performing privileged system modifications.
Question
Company policy requires that all company laptops meet the following baseline requirements:
Software requirements:
Antivirus Anti-malware Anti-spyware Log monitoring Full-disk encryption Terminal services enabled for RDP Administrative access for local users Hardware restrictions:
Bluetooth disabled FireWire disabled WiFi adapter disabled Ann, a web developer, reports performance issues with her laptop and is not able to access any network resources. After further investigation, a bootkit was discovered and it was trying to access external websites. Which of the following hardening techniques should be applied to mitigate this specific issue from reoccurring? (Select TWO).
Options
- AGroup policy to limit web access
- BRestrict VPN access for all mobile users
- CRemove full-disk encryption
- DRemove administrative access to local users
- ERestrict/disable TELNET access to network resources
- FPerform vulnerability scanning on a daily basis
- GRestrict/disable USB access
How the community answered
(33 responses)- B3% (1)
- C12% (4)
- D76% (25)
- E3% (1)
- F6% (2)
Why each option
A bootkit on Ann's laptop was spreading via removable media and exploiting local admin privileges to persist. Restricting USB access removes the primary infection vector, and removing admin rights prevents the bootkit from performing privileged system modifications.
A group policy restricting web access does not prevent bootkit installation or execution - it only limits outbound traffic after the system is already compromised.
Restricting VPN access for mobile users is unrelated to bootkit installation or the identified infection vector on a local laptop.
Removing full-disk encryption weakens the overall security posture and does nothing to prevent or remediate a bootkit infection.
Bootkits require elevated privileges to install and persist in the boot sector or master boot record; removing local administrative access prevents the malware from performing privileged operations, writing to protected system areas, and surviving reboots.
Disabling TELNET access affects remote terminal connectivity but does not address how the bootkit was installed or how it persists on the local system.
Daily vulnerability scanning is a detective control that identifies existing weaknesses but does not prevent a bootkit from being installed or re-installed via USB or exploited admin privileges.
Bootkits are commonly delivered via USB removable media; restricting or disabling USB access eliminates this primary infection vector and prevents reintroduction of the malware onto the system.
Concept tested: Bootkit mitigation via USB restriction and privilege removal
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/rootkits-malware
Topics
Community Discussion
No community discussion yet for this question.