100-160 Question 13
Select 4An organization recently experienced a data breach where an attacker exploited an unpatched vulnerability in their web application. The breach compromised sensitive customer data. To mitigate such incidents in the future, the organization is implementing a multi-layered security approach. Which of the following actions align with the principles of defense-in-depth and the CIA triad?
- A
Deploying a web application firewall (WAF) to monitor and block malicious traffic.
- B
Regularly updating and patching the web application and associated systems.
- C
Implementing strong password policies for employees and enforcing multi-factor authentication (MFA).
- D
Relying solely on an antivirus solution to protect the organization's infrastructure.
- E
Training employees on recognizing phishing attempts and social engineering tactics.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Defense-in-depth is a multi-layered security approach that combines various controls to address vulnerabilities, threats, and attack vectors. Actions such as deploying a WAF, patching systems, enforcing strong authentication, and educating employees align with this strategy while also supporting the principles of the CIA triad (confidentiality, integrity, and availability). Relying solely on antivirus software does not provide comprehensive protection and is not sufficient for mitigating complex threats.
- A. Correct.
Deploying a web application firewall (WAF) is an example of a preventative control that aligns with the defense-in-depth strategy. It enhances confidentiality and integrity by protecting applications from malicious traffic.
- B. Correct.
Regularly updating and patching systems addresses vulnerabilities, reducing the risk of exploitation. This supports availability by ensuring systems remain secure and operational.
- C. Correct.
Strong password policies and multi-factor authentication (MFA) strengthen access controls, enhancing confidentiality and integrity by preventing unauthorized access.
- D. Incorrect.
Relying solely on an antivirus solution is insufficient for a defense-in-depth approach, as it focuses only on endpoint protection and does not address other attack vectors or vulnerabilities.
- E. Correct.
Training employees on recognizing phishing attempts is a critical component of defense-in-depth. It addresses the human factor and reduces risks related to social engineering attacks, which can compromise confidentiality, integrity, and availability.