A systems administrator needs to implement a security control that will prevent unknown malware from infecting a system in case the antivirus solution fails. Which of the following should the…

The correct answer is A. A software whitelist. A software whitelist (also called application whitelisting or application control) is an explicit list of approved, trusted programs that are permitted to execute on a system. Any executable not on the whitelist is blocked by default-including unknown, zero-day, or…

Security

Question

A systems administrator needs to implement a security control that will prevent unknown malware from infecting a system in case the antivirus solution fails. Which of the following should the administrator implement?

Options

AA software whitelist
BFile integrity monitoring
CA host-based IDS
DHardened baselines

How the community answered

(48 responses)

A
81% (39)
B
6% (3)
C
10% (5)
D
2% (1)

Explanation

A software whitelist (also called application whitelisting or application control) is an explicit list of approved, trusted programs that are permitted to execute on a system. Any executable not on the whitelist is blocked by default-including unknown, zero-day, or signature-less malware that antivirus software might miss. This makes it highly effective as a defense-in-depth layer when antivirus fails. File integrity monitoring detects unauthorized changes but does not actively block execution. A host-based IDS alerts on suspicious behavior but is detection-focused, not prevention-focused, and still relies on signatures or heuristics similar to AV. Hardened baselines reduce attack surface but do not prevent unknown executables from running if they are somehow introduced to the system.

Topics

#Software whitelisting#Malware prevention#Security controls#Endpoint security

Community Discussion

No community discussion yet for this question.

Full CV0-004 Practice