Objective 2.5: Explain the purpose of mitigation techniques used to secure the enterprise
Security+ SY0-701 practice question
A hospital's lobby kiosks run a single patient check-in application. Last month, a visitor ran a malicious program on one kiosk, and the antivirus software did not detect it because no signature for it existed yet. The security team wants to stop any unapproved program from executing on the kiosks, no matter how the program arrives. Which mitigation BEST meets this requirement?
- Update the antivirus signatures on the kiosks every hour
Signature updates only help once a signature exists. The malware in this incident had no signature, and the requirement is to block any unapproved program, known or not.
- Enable the host-based firewall and block all inbound connections
A host-based firewall controls network traffic, not which programs can execute. It would not stop a program that a visitor launches locally, for example from a USB drive.
- Enable full-disk encryption on the kiosks
Full-disk encryption protects data at rest if a device is lost or stolen. It does nothing to stop a program from running while the kiosk is powered on and unlocked.
- Configure an application allow list on the kiosks(Correct)
Correct. An allow list blocks every program that is not on the approved list, regardless of how it reached the kiosk or whether antivirus recognizes it.
Explanation
An application allow list permits only explicitly approved programs to run and blocks everything else by default. Because it does not depend on recognizing malware, it stops new and unknown threats as well as known ones. It works best on single-purpose systems like kiosks, where the list of approved software is short and rarely changes.