ITPEC FE Subject B October 2024 Question 17

Topic: Security Scenarios

From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.

Company A is an e-commerce company specializing in sporting goods. One morning, employee X of the company's accounting department starts up his PC to begin his work. When he logged into his PC, he saw an unfamiliar screen with the following message:

*** Attention ***Your files have been encrypted. All of your important files have been encrypted. To restore these files, please follow these steps:1. transfer $500 worth of cryptcurrency to the currency address provided:   Address: 1ABCD.... EFGH2. As soon as the transfer is confirmed, we will send you the key to decrypt the files.3. If the transfer is not confirmed within 48 h, the decryption key will be deleted and the files will be lost forever.Contact: [email protected]

The accounting department immediately requested the security team in company A to help resolve the situation. The security team analyzed all the PCs in the accounting department, including that of employee X, and noted the following:

1.A total of tow compromised PCs were found. One PC was used by Employee X and the other PC was shared by multiple employees.2.IDS/IPS was not installed in the accounting department LAN, delaying detection of ransomware.3.The shared PC was backed up daily, and important data could be restored from the backup at the time when the PC was not compromised by the ransomware.4.Employee X's PC was not backed up, and important data could not be restored.5.The ransomware was saved on Employee X's PC as an attachment file of an email sent by a company pretending to be a business partner. The email envelope and content were sophisticatedly disguised and difficult to detect through enhanced spam filters.6.Employee X inadvertently executed the attached file and allowed the ransomware to invade his PC.7.After compromising Employee X's PC, the ransomware attempted to compromise other PCs in the LAN by taking advantage of vulnerabilities in the target OS, but succeeded only in compromising the shared PC, which had neglected to apply OS security patches.8.On both PCs, the anti-virus software versions and virus definition files were checked for updates on a daily basis and maintained up-to-date.9.Both PCs had OS storage encryption feature enabled, but it was not effective against the ransomware attack in this incident.

The security team and the accounting department decided to take the following approaches and specific measures as a plan to strengthen the measures against future ransomware attacks.

Table 1. Approaches and Specific Measures (excerpts)

ApproachesSpecific Measures
PreventionUser education and trainingA
DetectionNetwork monitoring with IDS/IPS
Data ProtectionB

Answer group

OptionAB

Explanation

A: OS updates, B: Data backup — each measure must close a gap the findings reveal, not repeat a control that was already in place.

  • •Prevention (A): by finding 7, the ransomware reached the shared PC only because its OS security patches had not been applied. Keeping the OS updated would have stopped that spread. The email route of findings 5 and 6 is covered by the user education already in the table.
  • •Data protection (B): by findings 3 and 4, the shared PC, backed up daily, was restored, while Employee X's PC, never backed up, lost its data. Backup is what made the difference.

Answer (c)

Why not others:

  • •(a) and (b) — SPAM filter enhancement: finding 5 says the email got past spam filters that were already enhanced
  • •(e) and (f) — virus definition updates: finding 8 says the definitions on both PCs were already updated daily
  • •(b), (d) and (f) — data encryption: finding 9 says storage encryption was enabled and did not help; ransomware encrypts files it can already read, so encrypting them first does not protect them

Key rule: Encryption protects confidentiality; against ransomware, availability is restored from a backup that the infection cannot reach.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.