200-201 Question 7
Select 3A cybersecurity analyst is investigating a security incident where an employee's device was compromised after visiting a malicious website. To prevent similar incidents in the future, the analyst recommends implementing a layered security approach. Which combination of network, endpoint, and application security systems would best mitigate this type of threat?
- A
Web Application Firewall (WAF) to monitor and filter HTTP/HTTPS traffic to web applications
- B
Endpoint Detection and Response (EDR) to monitor and respond to threats on endpoints
- C
URL filtering to block access to known malicious websites
- D
Antivirus software to scan and remove malware on the endpoint
- E
Intrusion Prevention System (IPS) to detect and block malicious network traffic
Show answer and explanation
Correct answers: B, C, D
Explanation
To prevent endpoint compromise from malicious websites, a layered approach is necessary. URL filtering directly blocks access to harmful websites, endpoint detection and response (EDR) monitors and mitigates suspicious behavior on devices, and antivirus software detects and removes malware. While WAF and IPS are valuable security tools, they are not directly relevant to addressing this specific type of threat.
- A. Incorrect.
A Web Application Firewall (WAF) is primarily designed to protect web applications from specific attacks like SQL injection or cross-site scripting (XSS). It does not directly prevent endpoint compromise from visiting malicious websites.
- B. Correct.
Endpoint Detection and Response (EDR) is effective in monitoring endpoints for suspicious activity and responding to threats, making it a key element in mitigating endpoint-based attacks.
- C. Correct.
URL filtering blocks access to known malicious websites, which directly addresses the root cause of this incident and helps prevent similar attacks.
- D. Correct.
Antivirus software is essential for detecting and removing malware that may have been downloaded from a malicious website, thereby reducing the risk of further compromise.
- E. Incorrect.
An Intrusion Prevention System (IPS) focuses on analyzing and blocking malicious network traffic. While useful, it does not directly address the issue of endpoint compromise from visiting malicious websites.