nerdexam
GIAC

GSEC · Question #321

An email system administrator deploys a configuration blocking all inbound and outbound executable files due to security concerns. What Defense in Depth approach is being used?

The correct answer is C. Vector Oriented. Blocking executable files at the email layer targets the specific attack vector (email) used to deliver malware, which is the Vector Oriented Defense in Depth strategy.

Defense in Depth and Protocols

Question

An email system administrator deploys a configuration blocking all inbound and outbound executable files due to security concerns. What Defense in Depth approach is being used?

Options

  • AProtected Enclaves
  • BUniform Protection
  • CVector Oriented
  • DInformation Centric

How the community answered

(48 responses)
  • A
    17% (8)
  • B
    8% (4)
  • C
    73% (35)
  • D
    2% (1)

Why each option

Blocking executable files at the email layer targets the specific attack vector (email) used to deliver malware, which is the Vector Oriented Defense in Depth strategy.

AProtected Enclaves

Protected Enclaves refers to segmenting systems or networks into isolated, high-trust zones, not targeting a specific delivery channel.

BUniform Protection

Uniform Protection applies the same security controls consistently across all assets, rather than focusing on a particular attack pathway.

CVector OrientedCorrect

Vector Oriented Defense in Depth focuses security controls on the specific channels or mechanisms (vectors) through which attacks are delivered. Blocking executables at the email gateway directly addresses email as an attack vector for malware delivery, rather than protecting data itself or segmenting the network.

DInformation Centric

Information Centric protection focuses on securing the data or information itself regardless of where it resides or how it travels.

Concept tested: Vector Oriented Defense in Depth strategy

Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Topics

#defense in depth#vector oriented#email security#executable filtering

Community Discussion

No community discussion yet for this question.

Full GSEC Practice