200-301 Question 404
Select 3You are a network administrator for a company and have noticed unauthorized access attempts to a critical server. After investigating, you find that the attacker exploited a known vulnerability in the server's operating system that had not been patched. Which of the following actions should you take to mitigate this issue and prevent future occurrences?
- A
Apply the latest security patches to the server's operating system.
- B
Implement a firewall rule to block all traffic to the server.
- C
Enable intrusion detection and prevention systems (IDPS) to monitor traffic.
- D
Perform regular vulnerability scans and address identified weaknesses.
- E
Disable the server’s network interface to prevent further exploitation.
Show answer and explanation
Correct answers: A, C, D
Explanation
To mitigate the issue and prevent future occurrences, you need to address the core vulnerability (by applying patches), implement monitoring and preventive measures (using IDPS), and perform regular assessments to identify and fix weaknesses. Blocking all traffic or disabling the server is either impractical or overly disruptive, making these inappropriate solutions.
- A. Correct.
Applying the latest security patches is essential to resolve the known vulnerability in the operating system.
- B. Incorrect.
Blocking all traffic to the server is not a practical solution as it would disrupt legitimate user access to the server.
- C. Correct.
Enabling IDPS helps monitor and block malicious traffic, providing an additional layer of security.
- D. Correct.
Performing regular vulnerability scans ensures that you can identify and mitigate potential weaknesses proactively.
- E. Incorrect.
Disabling the server’s network interface is an extreme measure that would render the server unusable for legitimate purposes.