SY0-701 Question 63
Single answerFile-basedA security analyst is investigating suspicious activity on a Linux web server that hosts customer records. The analyst suspects an attacker modified a critical configuration file to maintain persistence. The organization needs a control that will most effectively detect unauthorized changes to specific system and application files after deployment, without relying on constant manual review. Which control should the analyst recommend?
- A
Implement file integrity monitoring (FIM) with a baseline of approved files and alerting on changes
- B
Enable full-disk encryption on the server volume to prevent unauthorized file modification
- C
Deploy a network intrusion prevention system (NIPS) in front of the web server
- D
Require multifactor authentication (MFA) for administrators accessing the server
Show answer and explanation
Correct answer: A
Explanation
The best answer is file integrity monitoring (FIM) because the scenario focuses on detecting unauthorized modifications to specific files on a host system. FIM solutions maintain a known-good baseline using attributes such as hashes, permissions, size, and timestamps, then alert when monitored files change. This makes FIM particularly useful for identifying persistence mechanisms, tampered configuration files, and unauthorized changes to system binaries or application content. This aligns with common security best practices for change detection on critical systems and with guidance commonly referenced in security operations and compliance frameworks, such as monitoring critical files for unauthorized modification. The other controls are useful in a defense-in-depth strategy but do not directly satisfy the stated requirement as effectively as FIM.
- A. Correct.
Correct. File integrity monitoring (FIM) is specifically designed to detect changes to files by comparing current file states against a known-good baseline and generating alerts when monitored files are added, removed, or modified. In this scenario, the requirement is to detect unauthorized changes to critical configuration and application files after deployment, which is the primary purpose of FIM.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest if the storage media is lost or stolen, but it does not detect or prevent unauthorized changes made by someone or something with access to the running system. An attacker or malicious process operating on the live server can still modify files even when the disk is encrypted.
- C. Incorrect.
Incorrect. A network intrusion prevention system can detect and block suspicious network traffic, but it does not directly monitor the integrity of files on the host. It may help stop exploitation attempts over the network, but it is not the best control for identifying whether a specific configuration file was changed on the server.
- D. Incorrect.
Incorrect. MFA is an important preventive control for reducing the risk of unauthorized administrative access, but it does not provide visibility into whether critical files have been altered after login or by malware running under a legitimate account. It addresses access security, not file change detection.