SY0-701 Question 28
Single answerA security administrator must quickly reduce the risk of malware on a hospital's Windows-based medication dispensing system after threat intelligence identifies a new ransomware strain. The vendor states the dispensing application is a legacy application that depends on an outdated runtime and several background services, and the hospital cannot tolerate extended downtime because patient care would be affected. The administrator is considering compensating controls until the application can be upgraded. Which action is the BEST choice to reduce risk while minimizing operational impact?
- A
Implement application allow listing for only the approved dispensing application, its required runtime components, and documented dependent services during a scheduled maintenance window
- B
Apply a broad deny list of known ransomware file hashes and block all executable files from running in the application directory without testing
- C
Disable all nonessential Windows services immediately during business hours and reboot the server to ensure no malicious process remains active
- D
Restrict all user logons to the server and uninstall the legacy runtime so the outdated dependency can no longer be abused
Show answer and explanation
Correct answer: A
Explanation
The key issue is selecting a control that meaningfully reduces malware execution risk while accounting for technical implications such as legacy application behavior, dependencies, restricted activities, and downtime. In this scenario, application allow listing is the most effective compensating control because it permits only approved software to run, which is stronger than relying only on deny lists of known bad items. However, Security+ candidates must also recognize the operational side: legacy applications often require specific runtimes, helper processes, and background services, so changes should be tested and deployed in a maintenance window to avoid unintended outages. Depending on the implementation, a service restart or application restart may be required, but a full reboot during critical operations would be unnecessarily disruptive. This aligns with common security best practices from organizations such as NIST, including the emphasis on allow listing as an application control and on assessing operational impact and dependencies before implementing changes in production systems.
- A. Correct.
This is the best answer because application allow listing is a strong preventive control that limits execution to approved software, which is especially useful against unknown malware and ransomware variants. Including the documented runtime components and dependent services is critical in a legacy environment where the main application may fail if a required service or library is blocked. Performing the change during a scheduled maintenance window helps manage the risk of service interruption and allows validation of whether a service restart or application restart is needed. This approach balances security improvement with the hospital's low tolerance for downtime.
- B. Incorrect.
This is not the best answer because deny lists are inherently reactive and may not block new or modified ransomware variants that do not match known hashes. Blocking all executables in the application directory without testing could also prevent legitimate components of the legacy application from launching, especially if it uses local helper binaries or update agents. While deny lists can be useful as a supplemental control, they are weaker than allow listing for this scenario.
- C. Incorrect.
This is incorrect because making broad service changes immediately during business hours creates unnecessary operational risk in a healthcare setting. Legacy applications often rely on undocumented or poorly understood dependencies, so disabling services and rebooting the server could interrupt medication dispensing and patient care. In addition, a full reboot is a higher-impact action than a targeted service restart or application restart after testing.
- D. Incorrect.
This is incorrect because uninstalling the legacy runtime would likely break the dispensing application if it depends on that runtime, which the scenario explicitly states. Restricting logons may reduce some attack surface, but by itself it does not address malware execution risk as effectively as application allow listing. This option prioritizes removal of a vulnerable dependency without accounting for business continuity requirements.