Câu 103: CAS-005: CompTIA SecurityX

A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware stack of a domain controller. The forensic team cryptographically validated that both the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LDAP. Which of the following is the best way to reduce the risk of reoccurrence?

1. A. Enforcing allow lists for authorized network ports and protocols — đáp án hiện tại
2. B. Measuring and attesting to the entire boot chain
3. C. Rolling the cryptographic keys used for hardware security modules
4. D. Using code signing to verify the source of OS updates