Securing Your Organization Against Zero-Day Exploits | CASP+ Exam Question Answer | CompTIA

Steps to Assess and Prevent Zero-Day Exploits

Prev Question Next Question

Question

The Chief Information Security Officer (CISO) has asked the security team to determine whether the organization is susceptible to a zero-day exploit utilized in the banking industry and whether attribution is possible.

The CISO has asked what process would be utilized to gather the information, and then wants to apply signatureless controls to stop these kinds of attacks in the future.

Which of the following are the MOST appropriate ordered steps to take to meet the CISO's request?

Answers

A. 1. Perform the ongoing research of the best practices 2. Determine current vulnerabilities and threats 3. Apply Big Data techniques 4. Use antivirus control

B. 1. Apply artificial intelligence algorithms for detection 2. Inform the CERT team 3. Research threat intelligence and potential adversaries 4. Utilize threat intelligence to apply Big Data techniques

C. 1. Obtain the latest IOCs from the open source repositories 2. Perform a sweep across the network to identify positive matches 3. Sandbox any suspicious files 4. Notify the CERT team to apply a future proof threat model

D. 1. Analyze the current threat intelligence 2. Utilize information sharing to obtain the latest industry IOCs 3. Perform a sweep across the network to identify positive matches 4. Apply machine learning algorithms.

Show Answer

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

The correct answer for this scenario would be option D:

Analyze the current threat intelligence
Utilize information sharing to obtain the latest industry IOCs
Perform a sweep across the network to identify positive matches
Apply machine learning algorithms.

Here is a detailed explanation of each step:

Analyze the current threat intelligence: This step involves gathering and analyzing all available information about the zero-day exploit utilized in the banking industry. This information may come from various sources, such as industry reports, security vendors, and security researchers. By analyzing the current threat intelligence, the security team can determine the severity and impact of the threat and identify any vulnerabilities in the organization's security posture.
Utilize information sharing to obtain the latest industry IOCs: Information sharing is an essential component of modern cybersecurity. It involves sharing threat intelligence and Indicators of Compromise (IOCs) among organizations and security vendors. By utilizing information sharing, the security team can obtain the latest IOCs related to the zero-day exploit utilized in the banking industry. IOCs are pieces of information that can be used to identify malicious activity, such as IP addresses, domain names, and file hashes.
Perform a sweep across the network to identify positive matches: Once the security team has gathered the latest IOCs, they can perform a sweep across the organization's network to identify any positive matches. Positive matches are network activity that matches one or more of the IOCs. By identifying positive matches, the security team can determine whether the organization is susceptible to the zero-day exploit utilized in the banking industry.
Apply machine learning algorithms: Finally, the security team can apply machine learning algorithms to detect and prevent future zero-day exploits. Machine learning algorithms can learn from historical data and detect patterns and anomalies that may indicate malicious activity. By applying machine learning algorithms, the security team can implement signatureless controls that can detect and prevent new and unknown threats, including zero-day exploits.

In summary, the above-mentioned ordered steps involve gathering and analyzing current threat intelligence, utilizing information sharing to obtain the latest IOCs, performing a sweep across the network to identify positive matches, and applying machine learning algorithms to implement signatureless controls that can detect and prevent future zero-day exploits.

Prev Question Next Question