300-215 Question 134
Select 3After investigating a ransomware attack in your organization's network, you determine that the attacker exploited an unpatched vulnerability in a public-facing application. As part of the post-incident analysis, what actions should you recommend to prevent similar incidents in the future?
- A
Implement a patch management process to ensure timely updates for all software and applications.
- B
Conduct regular vulnerability scans on public-facing applications and systems.
- C
Enable unnecessary services on public-facing servers to increase functionality.
- D
Deploy a Web Application Firewall (WAF) to monitor and filter malicious traffic targeting web applications.
- E
Disable logging on public-facing systems to avoid consuming additional resources.
Show answer and explanation
Correct answers: A, B, D
Explanation
Post-incident analysis involves identifying the root cause of the incident and recommending actions to address vulnerabilities and improve the organization's security posture. Implementing a patch management process, conducting regular vulnerability scans, and deploying a WAF directly address the identified issue of an unpatched vulnerability and enhance defenses against similar attacks. Conversely, enabling unnecessary services or disabling logging would weaken security and are not recommended.
- A. Correct.
Implementing a patch management process ensures vulnerabilities are addressed promptly, reducing the attack surface for future incidents.
- B. Correct.
Regular vulnerability scans help identify weaknesses in public-facing systems, allowing proactive mitigation before they can be exploited.
- C. Incorrect.
Enabling unnecessary services increases the attack surface and contradicts security best practices, making this an incorrect recommendation.
- D. Correct.
Deploying a Web Application Firewall (WAF) adds an additional layer of protection by filtering and blocking malicious traffic targeting web applications.
- E. Incorrect.
Disabling logging would hinder the ability to detect and investigate incidents, making this a poor recommendation.