Question

A threat advisory alert was just emailed to the IT security staff. The alert references specific types of host operating systems that can allow an unauthorized person to access files on a system remotely. A fix was recently published, but it requires a recent endpoint protection engine to be installed prior to running the fix.

Which of the following MOST likely need to be configured to ensure the system are mitigated accordingly? (Select two.)

1. Antivirus
2. HIPS
3. Application whitelisting
4. Patch management
5. Group policy implementation
6. Firmware updates

Answer 1

Answer –

The most likely to be configured is patch management and firmware updates, that is, the options (4) and (6).

Explanation –

1. Since the threat allows unauthorized access, so there is no need to update the antivirus and in fact, an antivirus is a type of software that could come under a patch.
2. HIPS is also known as the Host-based Intrusion Prevention System, which fights from the cyber-attack.
3. In an application whitelisting, the unwanted applications are kept away from the system.
4. In the patch management, the code of existing software or application is changed in terms of patches to keep the system updated. Therefore, the system is updated to reduce threat attacks.
5. Group policy implementation is not so secure since there are some deficiencies in the group policy.
6. Configuring the firmware is a good option because the firmware is the core software of the system loaded in the ROM.