712-50 Question 308
Single answerVirus, Trojans and Malware, and other Malicious Code Threats (6 questions)A global manufacturing company discovers that several engineering workstations were infected with malware delivered through a trojanized software update from a trusted third-party vendor. Initial containment succeeded, but the board is concerned about business disruption, legal exposure, and the possibility of similar supply-chain malware incidents affecting other critical environments. As the CISO, you are asked to recommend the MOST effective strategic control to reduce the risk of recurrence while preserving operational continuity. Which action should you prioritize?
- A
Implement application allowlisting, code-signature validation, and staged deployment of third-party updates in isolated test environments before enterprise rollout
- B
Increase the frequency of full endpoint antivirus scans on all engineering workstations from weekly to daily
- C
Block all third-party software updates and permit only manual installation by local administrators after users report a business need
- D
Require employees in engineering to complete additional phishing-awareness training focused on malicious email attachments
Show answer and explanation
Correct answer: A
Explanation
This question tests executive-level decision-making about malicious code threats in a real-world supply-chain compromise scenario. A CCISO is expected to prioritize strategic controls that reduce enterprise risk at scale, not just tactical responses. When malware is introduced through a trojanized vendor update, the most effective control is strengthening software supply-chain assurance and deployment governance: validating code signatures, using application allowlisting, and promoting updates through staged testing environments before full rollout. These measures align with established best practices from sources such as NIST SP 800-161 on Cybersecurity Supply Chain Risk Management, NIST SP 800-53 controls related to software integrity and allowlisting, and guidance from CISA and other security authorities on managing third-party software risk. Antivirus and awareness training remain useful supporting controls, but they do not address the primary risk vector in this scenario. A CISO should focus on preventive and governance-based controls that reduce enterprise-wide exposure while maintaining business operations.
- A. Correct.
Correct. In a supply-chain malware scenario involving a trojanized trusted update, the strongest strategic response is to improve software trust controls and deployment governance. Application allowlisting limits execution to approved software, code-signature validation helps verify publisher integrity, and staged deployment in isolated testing reduces the chance that malicious updates propagate broadly before detection. This approach addresses the root issue: malicious code entering through the software supply chain rather than through typical user behavior. It also supports operational continuity because updates can still occur under controlled conditions.
- B. Incorrect.
Incorrect. More frequent antivirus scans may improve detection opportunities, but they are primarily a detective or reactive control. Modern trojans and supply-chain malware may evade signature-based tools, especially early in an attack. Daily scans do not meaningfully address the underlying governance weakness in how third-party software updates are trusted, validated, and promoted into production.
- C. Incorrect.
Incorrect. Completely blocking third-party updates and shifting to manual local-administrator installation creates significant operational and security problems. It delays legitimate patching, increases inconsistency, expands privileged access, and may actually raise risk. Good security leadership seeks controlled, risk-based software assurance processes, not ad hoc manual exceptions that undermine centralized oversight.
- D. Incorrect.
Incorrect. Security awareness training is valuable, but this scenario involves malware delivered via a trusted vendor software update, not a user-initiated phishing event. Additional phishing training would have limited impact on preventing recurrence of this particular attack path. Choosing this option reflects the common misconception that all malware incidents are primarily user-awareness failures.