200-201 Question 8
Select 3A cybersecurity analyst at your organization notices unusual traffic patterns coming from an endpoint device on the network. Upon further investigation, the analyst determines that the device has been compromised and is communicating with a known malicious server. Which combination of network, endpoint, and application security systems would be most effective in detecting and mitigating such a threat?
- A
Endpoint Detection and Response (EDR) to identify and isolate the compromised device
- B
Intrusion Prevention System (IPS) to block communication with the malicious server
- C
Web Application Firewall (WAF) to monitor and block web-based malicious activities
- D
Network Access Control (NAC) to enforce device authentication and restrict network access
- E
Anti-virus software to detect and remove malware on the affected endpoint
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively detect and mitigate the threat, a combination of EDR, IPS, and NAC systems is required. EDR identifies and isolates the compromised device, IPS blocks communication with the malicious server, and NAC enforces access control policies to limit the impact of the compromised device. While anti-virus software and WAF have their uses, they do not fully address the specific scenario of detecting and blocking unusual traffic patterns from a compromised endpoint.
- A. Correct.
Endpoint Detection and Response (EDR) is crucial for detecting unusual behaviors and isolating compromised devices to prevent further damage.
- B. Correct.
An Intrusion Prevention System (IPS) can block communication with known malicious servers by inspecting network traffic and applying security policies.
- C. Incorrect.
A Web Application Firewall (WAF) is designed to protect web applications, not to handle endpoint-based traffic or block malicious servers in this scenario.
- D. Correct.
Network Access Control (NAC) helps enforce security policies such as device authentication and can restrict network access for compromised devices.
- E. Incorrect.
Anti-virus software is helpful for detecting and removing malware, but it is not sufficient on its own for detecting or mitigating communication with a malicious server.