D340 Cyber Defense and Countermeasures - Set 2 - Part 2

Correct Answer: A process verifying firmware and OS components are signed before loading

Secure boot validates cryptographic signatures on boot components, preventing bootkits and unauthorized operating systems from loading.

Correct Answer: A hardware chip providing secure key storage and integrity measurement

A TPM securely stores cryptographic keys and records platform integrity measurements, supporting disk encryption and attestation of system state.

Correct Answer: Isolating an application so its actions cannot affect the wider system

Sandboxing confines an application's access to files, memory, and system resources, limiting damage if the application is compromised.

Correct Answer: Containing web-borne threats within a disposable isolated environment

Isolating browsing in a disposable virtual environment ensures that malicious web content compromises only that container, which is then discarded.

Correct Answer: Malicious attachments, links, and impersonation attempts

Email security gateways scan for malicious attachments and URLs, detect impersonation, and quarantine suspicious messages before delivery.

Correct Answer: Redirecting links through a service that checks them at click time

Rewriting links routes clicks through an inspection service, catching sites that were benign at delivery but weaponized afterward.

Correct Answer: Executing an attachment in isolation to observe malicious behavior

Detonation runs suspicious attachments in an isolated environment and observes behavior, detecting malware that signature scanning would miss.

Correct Answer: Blocking resolution of domains known to be malicious

DNS filtering prevents systems from resolving known malicious domains, disrupting malware delivery, phishing, and command and control communication.

Correct Answer: Nearly all network activity begins with a DNS lookup

Because almost every connection starts with name resolution, DNS provides broad visibility and a single efficient point to block malicious destinations.

Correct Answer: Controlling and restricting outbound traffic leaving the network

Egress filtering restricts what internal systems may send outbound, disrupting command and control and data exfiltration that inbound filtering cannot address.

Correct Answer: Focus traditionally centers on inbound threats rather than outbound control

Defensive attention historically focused on keeping attackers out. Controlling outbound traffic is equally valuable for detecting and disrupting active compromise.

Correct Answer: Containing an intrusion to a limited zone

Segmentation ensures that compromising one zone does not grant access to the entire environment, directly limiting an attacker's reach.

Correct Answer: Ransomware commonly targets reachable backups to prevent recovery

Attackers deliberately destroy accessible backups before deploying ransomware. Isolated or immutable backups preserve the ability to recover without paying.

Correct Answer: A backup that cannot be modified or deleted for a defined retention period

Immutable storage prevents alteration or deletion during the retention window, ensuring a recoverable copy survives even administrative credential compromise.

Correct Answer: It confirms recovery is actually possible before a real incident

Backups frequently fail silently. Only performing an actual restore proves that data is recoverable and that staff can execute the procedure under pressure.

Correct Answer: Operational disruption caused by a faulty update

Testing in a representative environment identifies compatibility problems before wide deployment, balancing security urgency against operational stability.

Correct Answer: Prioritize and expedite them given direct exposure to attack

Internet-facing systems are continuously scanned and attacked, so vulnerabilities in them are exploited fastest and warrant the most urgent remediation.

Correct Answer: Blocking exploitation at a network or application control while awaiting a real patch

Virtual patching uses a WAF or IPS rule to block exploit attempts against a known vulnerability, providing interim protection when patching must be delayed.

Correct Answer: Ensuring systems consistently match an approved secure state

Configuration management defines and enforces desired secure state, detecting and correcting drift that would otherwise reintroduce vulnerabilities over time.

Correct Answer: Configurations are version-controlled, reviewable, and consistently reproducible

Defining infrastructure in code allows security review, version history, and repeatable deployment, eliminating inconsistent manually configured systems.