CA1-005: CompTIA SecurityXDemo

Question

An organization receives OSINT reports of increased ransomware targeting file shares at peer companies. It wants to deploy hardening policies to servers and workstations to contain possible ransomware. Which action should an engineer take to best meet this goal?

A Allow only interactive log-in for users on workstations and restrict port 445 traffic to fileshares.
B Enable biometric authentication mechanisms on user workstations and block port 53 traffic.
C Instruct users to use a password manager when generating new credentials and secure port 443 traffic.
D Give users permission to rotate administrator passwords and deny port 80 traffic.

Explanation

SMB file sharing uses TCP port 445. Restricting port 445 traffic to authorized file-share systems limits SMB-based lateral movement, reducing ransomware’s ability to reach additional hosts and shares. Limiting workstation access to interactive logon further reduces inappropriate remote use of user accounts. Microsoft recommends SMB traffic segmentation and endpoint isolation to reduce threats between devices.

Learn more

CA1-005: CompTIA SecurityXDemo

AstroTutor

Notes

Readiness

QuestionQ104

Community Discussion