Monitoring Data

Question 1 of 6

A Windows administrator suspects that a critical system binary may have been replaced by malware after a recent compromise. They want to scan all protected operating system files and automatically restore any that have been modified. Which built-in Windows tool performs this function?

Tripwire — creates a cryptographic hash baseline and alerts on any file changes SFC (System File Checker) — scans all protected Windows OS files, verifies their integrity, and automatically replaces modified files with known-good versions Group Policy — enforces file permissions to prevent unauthorized modifications to system files Windows Defender — the built-in antivirus that scans for and removes malware including trojaned system binaries

Question 2 of 6

A Linux security engineer wants to implement file integrity monitoring that creates cryptographic baselines of important system files and provides real-time alerts when any monitored file is modified. Which tool is BEST suited for this purpose?

SFC (System File Checker) — the standard FIM tool for Linux environments iptables — a Linux firewall tool that can monitor and block file system changes in real time Tripwire — a Linux FIM tool that creates cryptographic hash baselines and can provide real-time monitoring for file modifications SELinux — provides file integrity monitoring through its mandatory access control policies

Question 3 of 6

A DLP solution is deployed inline on the corporate network and inspects packets in real time. It detects and blocks a file transfer containing Social Security numbers being sent to an external server. Which data state and DLP type is this?

Data at rest — storage DLP scanning files on a server for misplaced sensitive information Data in motion — network DLP monitoring and blocking sensitive information as it traverses the network Data in use — endpoint DLP monitoring active memory access on the device performing the transfer Data at rest — the DLP solution scanning the destination server to verify the sensitive file was not stored

Question 4 of 6

An employee on a remote laptop, not connected to the corporate network, attempts to copy a file containing credit card numbers to a personal USB drive. A DLP agent on the laptop blocks the transfer. Which data state and DLP type prevented this, and why can this enforcement occur without a network connection?

Data in motion — network DLP intercepted the USB transfer by monitoring the wireless connection the laptop uses Data in use — endpoint DLP running as an agent on the laptop enforces policy locally at the operating system level, independent of any network connection Data at rest — storage DLP on the laptop’s file system blocked access to the file before the copy could begin Data in motion — cloud-based DLP intercepted the file transfer before it reached the USB device

Question 5 of 6

In November 2008, a worm spread across the US Department of Defense’s classified and unclassified networks by replicating itself through removable storage devices. The DoD responded by banning all USB storage media and deploying local DLP agents on every device. What was the name of the worm, and what DLP capability did the DoD deploy to prevent future infections?

Stuxnet — the DoD deployed network-based DLP to monitor all outbound USB traffic across the enterprise network WannaCry — the DoD deployed cloud-based DLP to scan removable media for ransomware signatures before files could be executed agent.btz — the DoD deployed endpoint DLP agents with USB blocking policies on all devices, preventing any removable storage from being accessed NotPetya — the DoD deployed data-at-rest DLP scanning all file servers for the worm’s signature after the infection

Question 6 of 6

In November 2016, a Boeing employee accidentally emailed personal information for 36,000 employees to a personal address. The data was in hidden spreadsheet columns and included Social Security numbers. Which security control would have BEST prevented this incident?

File Integrity Monitoring — Tripwire would have detected the unauthorized access to the spreadsheet and blocked the email Outbound email DLP — it scans email attachments for sensitive data patterns (such as SSN formats) and blocks the message before it is sent if the patterns are detected Inbound email filtering — the receiving mail server would have blocked the email because the SSN patterns in the spreadsheet triggered its spam filter Data-at-rest DLP — scanning the spreadsheet on the file server would have deleted or quarantined the file, preventing the employee from emailing it

Matching

Match each description to the correct monitoring or DLP concept.

1. A security process that establishes cryptographic baselines of important system files and generates alerts when any monitored file is modified, added, or deleted

2. The DLP data state covering information actively traversing a network; inspected inline by a network appliance, NGFW integration, or cloud service

3. The DLP data state covering information stored on file servers, databases, or backup media; scanned to identify misplaced sensitive files and verify encryption

4. An agent-based DLP solution installed on individual endpoint devices; monitors user activity locally and enforces policy even when the device is offline

1. 2. 3. 4.

A. File Integrity Monitoring (FIM)

B. Data in Motion

C. Data at Rest

D. Endpoint DLP

Monitoring Data — Quiz

Matching