CAS-003 · Question #797
A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an…
The correct answer is C. Deploying host-based firewalls and shipping the logs to the SIEM. The investigation found undocumented services running on the endpoint and unusual port 80 traffic - behaviors that antivirus failed to detect. Host-based firewalls can log all inbound and outbound connection attempts, including traffic from unauthorized services. Shipping those…
Question
A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an unusual spike in port 80 traffic from the IP address of a desktop used by a customer relations employee who has access to several of the compromised accounts. Subsequent antivirus scans of the device do not return an findings, but the CIRT finds undocumented services running on the device. Which of the following controls would reduce the discovery time for similar in the future.
Options
- AImplementing application blacklisting
- BConfiguring the mall to quarantine incoming attachment automatically
- CDeploying host-based firewalls and shipping the logs to the SIEM
- DIncreasing the cadence for antivirus DAT updates to twice daily
How the community answered
(57 responses)- A9% (5)
- B4% (2)
- C74% (42)
- D14% (8)
Explanation
The investigation found undocumented services running on the endpoint and unusual port 80 traffic - behaviors that antivirus failed to detect. Host-based firewalls can log all inbound and outbound connection attempts, including traffic from unauthorized services. Shipping those logs to the SIEM enables correlation, alerting, and rapid anomaly detection - for example, an alert on unexpected services establishing outbound connections on unusual ports. This combination significantly reduces dwell time by providing visibility at the host level. Application blacklisting (A) can prevent known malicious applications but does not help detect novel undocumented services or improve log visibility. Mail quarantine (B) addresses the initial infection vector but not post-compromise detection. Increasing antivirus DAT updates (D) is ineffective against zero-days or fileless malware that already evaded AV detection.
Topics
Community Discussion
No community discussion yet for this question.