100-160 Question 108
Select 3A company has deployed endpoint detection and response (EDR) solutions across its network. During a routine security audit, it was discovered that employees frequently download files from unknown external websites. Which endpoint security measures should the company implement to mitigate the risk of malware infections in this scenario?
- A
Enable application whitelisting to restrict unauthorized software execution.
- B
Implement a next-generation antivirus (NGAV) solution to detect malicious files.
- C
Disable all internet access for employees to prevent downloads.
- D
Enforce file integrity monitoring to identify unauthorized file changes on endpoints.
- E
Configure web filtering to block access to untrusted or malicious websites.
Show answer and explanation
Correct answers: A, B, E
Explanation
To mitigate the risk of malware infections from downloading files from unknown external websites, the company should adopt a layered security approach. Application whitelisting ensures only authorized applications are executed, NGAV helps detect and block malicious files, and web filtering prevents access to harmful websites. These measures collectively address the threat while maintaining operational productivity.
- A. Correct.
Application whitelisting ensures that only approved and trusted applications can run on endpoints, reducing the risk of malware execution from unverified sources.
- B. Correct.
Next-generation antivirus solutions are capable of detecting and preventing malicious files, even those using advanced obfuscation techniques.
- C. Incorrect.
Disabling all internet access is impractical for most business operations and would likely disrupt productivity.
- D. Incorrect.
File integrity monitoring is useful for detecting changes to critical files but does not prevent malware from being downloaded or executed.
- E. Correct.
Web filtering helps prevent access to malicious or untrusted websites, reducing the likelihood of downloading harmful files.