350-201 Question 64
Select 3You are tasked with evaluating the security controls of a company’s network environment. During your assessment, you discover that the organization has outdated firewall rules, no centralized logging system, and an overly permissive access control policy. Which of the following actions should you recommend to address these gaps?
- A
Implement a centralized Security Information and Event Management (SIEM) solution for logging and monitoring.
- B
Review and update the firewall rules to align with the principle of least privilege.
- C
Enable port forwarding on all external-facing devices to improve connectivity.
- D
Conduct a regular access review and enforce a role-based access control (RBAC) policy.
- E
Deploy additional wireless access points in the office to improve network availability.
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively address the identified security gaps, it is essential to implement a centralized SIEM solution, update the firewall rules to align with the principle of least privilege, and enforce a role-based access control policy. These steps enhance visibility, improve network segmentation, and ensure proper access management, directly mitigating the identified weaknesses in the environment.
- A. Correct.
Implementing a centralized SIEM solution is crucial for centralizing logging and monitoring, which improves incident detection and response capabilities. This directly addresses the gap of having no centralized logging system.
- B. Correct.
Reviewing and updating the firewall rules ensures that the principle of least privilege is enforced, reducing unnecessary exposure and mitigating security risks caused by outdated rules.
- C. Incorrect.
Enabling port forwarding on all external-facing devices could expose the network to additional risks and does not address the identified gaps.
- D. Correct.
Conducting regular access reviews and enforcing RBAC helps ensure that access is limited to what users need for their roles, addressing the overly permissive access control policy.
- E. Incorrect.
Deploying additional wireless access points is unrelated to the identified security gaps and focuses on improving network availability rather than security.