CAS-005 · Question #64
A security engineer is given the following requirements: - An endpoint must only execute Internally signed applications - Administrator accounts cannot install unauthorized software. - Attempts to…
The correct answer is D. Configuring application control with blocked hashes and enterprise-trusted root certificates. Application control with blocked hashes and enterprise-trusted root certificates ensures that only internally signed applications can be executed, aligning with the requirement to limit executable files to those signed by the organization. By blocking unauthorized hashes, the…
Question
A security engineer is given the following requirements:
- An endpoint must only execute Internally signed applications
- Administrator accounts cannot install unauthorized software.
- Attempts to run unauthorized software must be logged
Which of the following best meets these requirements?
Options
- AMaintaining appropriate account access through directory management and controls
- BImplementing a CSPM platform to monitor updates being pushed to applications
- CDeploying an EDR solution to monitor and respond to software installation attempts
- DConfiguring application control with blocked hashes and enterprise-trusted root certificates
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C4% (1)
- D85% (23)
Explanation
Application control with blocked hashes and enterprise-trusted root certificates ensures that only internally signed applications can be executed, aligning with the requirement to limit executable files to those signed by the organization. By blocking unauthorized hashes, the control prevents unauthorized software installations. This approach also meets the requirement to log attempts to run unauthorized software, as such events can be captured and logged by the application control
Community Discussion
No community discussion yet for this question.