100-160 Question 14
Select 3A company's web server was compromised, and a malicious actor exploited a code vulnerability to gain unauthorized access to sensitive customer data. Upon investigation, it was discovered that the web server had not been patched for months. Which of the following actions could have prevented this attack while adhering to the principles of defense-in-depth and the CIA triad?
- A
Conducting regular vulnerability scans and applying patches promptly
- B
Implementing a web application firewall (WAF) to filter malicious traffic
- C
Encrypting sensitive customer data to ensure confidentiality
- D
Disabling the server's logging services to reduce resource usage
- E
Training employees on social engineering prevention techniques
Show answer and explanation
Correct answers: A, B, C
Explanation
To prevent the described attack, the organization needs a layered defense strategy (defense-in-depth) that includes regular patching to address known vulnerabilities, a WAF to block malicious traffic, and encryption to maintain data confidentiality, even in the event of a breach. The CIA triad (confidentiality, integrity, and availability) and defense-in-depth principles guide these preventative measures.
- A. Correct.
Conducting regular vulnerability scans and applying patches promptly is a key part of hardening systems and reducing vulnerabilities. This would have closed the exploited code vulnerability.
- B. Correct.
Implementing a web application firewall (WAF) would help detect and block malicious traffic aimed at exploiting vulnerabilities, adding a layer to defense-in-depth.
- C. Correct.
Encrypting sensitive customer data ensures that even if a breach occurs, the data remains unreadable to unauthorized users, preserving confidentiality in the CIA triad.
- D. Incorrect.
Disabling the server's logging services would reduce resource usage but would also eliminate critical information needed for detecting and investigating security incidents. This action would not prevent the attack.
- E. Incorrect.
Training employees on social engineering prevention techniques is important for cybersecurity but is unrelated to the specific code vulnerability exploited in this scenario.