An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls…

Question

Options

• ADrop the tables on the database server to prevent data exfiltration.
• BDeploy EDR on the web server and the database server to reduce the adversary's capabilities.
• CStop the httpd service on the web server so that the adversary can not use web exploits.
• DUse microsegmentation to restrict connectivity to/from the web and database servers.
• EComment out the HTTP account in the /etc/passwd file of the web server.
• FMove the database from the database server to the web server.

• A
  8% (3)
• B
  56% (20)
• C
  8% (3)
• E
  3% (1)
• F
  25% (9)

Explanation

Deploying EDR on the web server and the database server to reduce the adversaries capabilities and using micro segmentation to restrict connectivity to/from the web and database servers are two compensating controls that will help contain the adversary while meeting the other requirements. A compensating control is a security measure that is implemented to mitigate the risk of a vulnerability or an attack when the primary control is not feasible or effective. EDR stands for Endpoint Detection and Response, which is a tool that monitors endpoints for malicious activity and provides automated or manual response capabilities. EDR can help contain the adversary by detecting and blocking their actions, such as data exfiltration, lateral movement, privilege escalation, or command execution. Micro segmentation is a technique that divides a network into smaller segments based on policies and rules, and applies granular access controls to each segment. Micro segmentation can help contain the adversary by isolating the web and database servers from other parts of the network, and limiting the traffic that can flow between

No community discussion yet for this question.