Implement Security Controls (e.g., Watchdogs, File Integrity Monitoring, Anti-Malware) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A government agency is deploying a new application on a hardened Linux server. The agency's security policy requires that any unauthorized change to the application's configuration files be detected and reported within 15 minutes. The team needs to implement a control that meets this requirement. What should the team implement?

   • AA manual process where an administrator checks the configuration files every hour.
   • BA watchdog timer that restarts the application if it detects that the configuration files have been modified.
   • CA file integrity monitoring tool that runs every 10 minutes and compares the current hashes of the configuration files against a known-good baseline.
   • DAn anti-malware scanner that runs every 5 minutes and scans the configuration files for known malware signatures.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is deploying a new application on a server that is accessible from the internet. The application is critical to the business and must be available 24/7. The security team wants to ensure that the application does not hang, that its configuration files are not tampered with, and that it is protected from malware. The team has a limited budget and must choose the most effective controls. Which combination of controls should the team implement?

   • AOnly install anti-malware software, since it can detect both malware and configuration changes.
   • BImplement a watchdog timer, deploy file integrity monitoring, and install anti-malware software.
   • COnly implement a watchdog timer, since it can detect both hangs and configuration changes.
   • DOnly deploy file integrity monitoring, since it can detect both configuration changes and malware.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is deploying a file integrity monitoring (FIM) solution for a critical application server. The team is concerned about the performance impact of running FIM on the server, as the application is I/O intensive. The team wants to minimize the performance impact while still detecting unauthorized changes to critical files. What should the team do?

   • AUse a manual process where an administrator checks the critical files for changes once a week.
   • BConfigure FIM to monitor only the critical files and directories, and schedule scans during off-peak hours.
   • CRun FIM continuously on all files on the server to ensure immediate detection of any change.
   • DDisable FIM and rely on the operating system's access control lists to prevent unauthorized changes.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is deploying a new application in a containerized environment. The security team is concerned about the risk of malware being introduced through a compromised container image. The team wants to implement a control that can detect and block malicious code before it is deployed. However, the team is also concerned about the performance impact of scanning every container image at runtime. What should the team do?

   • AUse a file integrity monitoring tool to verify that container images have not been tampered with, and rely on that to detect malware.
   • BOnly scan container images at runtime with a full anti-malware scanner that scans all files in the container.
   • CScan container images for malware during the build process, before they are pushed to the registry, and also scan them at runtime with a lightweight agent.
   • DOnly scan container images at build time and do not scan at runtime.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services company maintains a fleet of Linux servers running a custom trading application. The security team suspects that an attacker may have modified the application binary or its configuration files on one of the servers. The team wants to detect any unauthorized changes to these critical files as they happen, and also be able to verify the integrity of the files after a suspected compromise. What should the team implement?

   • ASet up a cron job that runs `chmod 444` on all critical files every hour to prevent any modifications.
   • BInstall an anti-malware agent that scans the files for known virus signatures on a daily basis.
   • CDeploy a file integrity monitoring tool that computes cryptographic hashes of the critical files at a baseline and then periodically re-computes and compares them.
   • DEnable the Linux audit daemon to log all file access events and review the logs manually at the end of each month.
   Reveal Solution Discussion Select an answer first