100-160 Question 12
Select 4A company recently experienced a ransomware attack that encrypted critical business data. Upon investigation, it was discovered that an employee clicked on a malicious link in a phishing email. Which of the following measures would best align with the principles of defense-in-depth to prevent similar incidents in the future?
- A
Implement employee cybersecurity awareness training programs.
- B
Deploy email filtering solutions to detect and block phishing emails.
- C
Regularly update and patch all software and operating systems.
- D
Restrict employee access to sensitive systems based on job requirements.
- E
Rely solely on antivirus software to detect and remove threats.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
Defense-in-depth is a security strategy that employs multiple layers of protection to address different attack vectors and minimize risks. In this scenario, combining employee training, technical controls (email filters), system hardening (patching), and access control (least privilege) creates a comprehensive approach to preventing and mitigating phishing attacks. Relying solely on antivirus software is not sufficient as it does not provide multiple layers of defense.
- A. Correct.
Implementing employee cybersecurity awareness training programs educates users on identifying phishing attempts and reduces the likelihood of human error, a key aspect of defense-in-depth.
- B. Correct.
Deploying email filtering solutions is a proactive technical control that helps prevent phishing emails from reaching users in the first place.
- C. Correct.
Regularly updating and patching software and operating systems reduces vulnerabilities that attackers could exploit, aligning with the principle of hardening systems.
- D. Correct.
Restricting access to sensitive systems based on job requirements minimizes the potential impact of an attack by limiting access to critical resources, following the principle of least privilege.
- E. Incorrect.
Relying solely on antivirus software is insufficient as it does not encompass a layered approach; defense-in-depth requires multiple overlapping protective measures.