CAS-002 · Question #893
The Chief Information Security Officer (CISO) at a large organization has been reviewing some security-related incidents at the organization and comparing them to current industry trends. The…
The correct answer is D. Implement group policy objects. Preventative technical controls that enforce policy at the OS level are more effective than administrative warnings or detective controls when users continue to violate USB policies.
Question
The Chief Information Security Officer (CISO) at a large organization has been reviewing some security-related incidents at the organization and comparing them to current industry trends. The desktop security engineer feels that the use of USB storage devices on office computers has contributed to the frequency of security incidents. The CISO knows the acceptable use policy prohibits the use of USB storage devices. Every user receives a popup warning about this policy upon login. The SIEM system produces a report of USB violations on a monthly basis; yet violations continue to occur. Which of the following preventative controls would MOST effectively mitigate the logical risks associated with the use of USB storage devices?
Options
- ARevise the corporate policy to include possible termination as a result of violations
- BIncrease the frequency and distribution of the USB violations report
- CDeploy PKI to add non-repudiation to login sessions so offenders cannot deny the offense
- DImplement group policy objects
How the community answered
(51 responses)- A8% (4)
- B16% (8)
- C4% (2)
- D73% (37)
Why each option
Preventative technical controls that enforce policy at the OS level are more effective than administrative warnings or detective controls when users continue to violate USB policies.
Revising policy to include termination is an administrative deterrent control, not a technical preventative control, and does not stop the violation from occurring.
Increasing report frequency is a detective control that identifies violations after the fact but does nothing to prevent them.
PKI and non-repudiation address accountability and proof of identity for legal purposes but do not technically prevent USB devices from being connected and used.
Group Policy Objects (GPOs) in a Windows domain environment allow administrators to technically block USB storage device installation and use at the operating system level, removing the ability to violate policy rather than just warning against it. This transforms the control from a deterrent into a true preventative technical control that does not rely on user compliance. GPO settings such as 'Removable Disks: Deny write access' and 'Removable Disks: Deny execute access' directly enforce the acceptable use policy.
Concept tested: GPO enforcement of USB device restrictions
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/security-policy-settings
Topics
Community Discussion
No community discussion yet for this question.