nerdexam
CompTIA

CAS-003 · Question #800

A financial institution has several that currently employ the following controls: The severs follow a monthly patching cycle. All changes must go through a change management process. Developers and…

The correct answer is B. Implement file integrity monitoring with automated alerts on the servers. File integrity monitoring with automated alerts would immediately detect unauthorized file changes such as unapproved patches, directly reducing the time between incident occurrence and discovery.

Enterprise Security Operations

Question

A financial institution has several that currently employ the following controls:

  • The severs follow a monthly patching cycle.
  • All changes must go through a change management process.
  • Developers and systems administrators must log into a jumpbox to access the servers hosting

the data using two-factor authentication.

  • The servers are on an isolated VLAN and cannot be directly accessed from the internal

production network. An outage recently occurred and lasted several days due to an upgrade that circumvented the approval process. Once the security team discovered an unauthorized patch was installed, they were able to resume operations within an hour. Which of the following should the security administrator recommend to reduce the time to resolution if a similar incident occurs in the future?

Options

  • ARequire more than one approver for all change management requests.
  • BImplement file integrity monitoring with automated alerts on the servers.
  • CDisable automatic patch update capabilities on the servers
  • DEnhanced audit logging on the jump servers and ship the logs to the SIEM.

How the community answered

(65 responses)
  • A
    5% (3)
  • B
    83% (54)
  • C
    3% (2)
  • D
    9% (6)

Why each option

File integrity monitoring with automated alerts would immediately detect unauthorized file changes such as unapproved patches, directly reducing the time between incident occurrence and discovery.

ARequire more than one approver for all change management requests.

Requiring additional approvers hardens the change management process for future requests but provides no detection mechanism when that process is bypassed, so it does not reduce time to resolution.

BImplement file integrity monitoring with automated alerts on the servers.Correct

File integrity monitoring (FIM) continuously hashes and compares critical system files against a known-good baseline and fires automated alerts the moment an unauthorized modification is detected. In this incident the unauthorized patch went undetected for days; FIM would have flagged the change at installation time rather than requiring the security team to manually discover it. Faster detection directly translates to faster resolution, which is exactly what the question asks for.

CDisable automatic patch update capabilities on the servers

Disabling automatic patch update capabilities does not prevent a privileged user from manually installing an unauthorized patch, which was the actual method used in this incident.

DEnhanced audit logging on the jump servers and ship the logs to the SIEM.

Enhanced jump-server audit logging captures authentication and session events but does not alert on file-level changes made on the target servers, so detection would still depend on manual log review.

Concept tested: File integrity monitoring for unauthorized change detection

Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Topics

#change management#file integrity monitoring#unauthorized changes#audit logging

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice