How did the anti-malware software most likely identify the file?

The file matched a signature in its malware database

The file was larger than normal

The user reported the file as suspicious

The file had been downloaded at night

Which action would most directly prevent this attack?

Installing the vendor's patch for the vulnerability

Requiring multifactor authentication (MFA) at login

Adding a host firewall rule that allows port 443

Enabling account lockout after 5 failed logins

A school's network already has a firewall. Which of the following best explains why each laptop should also run a host-based firewall?

It adds a layer of protection for that device if the network it is on is compromised

It speeds up the laptop's internet connection

It encrypts every file on the laptop

It replaces the need for anti-malware software

What happens to an inbound remote desktop (RDP) connection on port 3389?

It is dropped because no rule matches

Which rule should the administrator add at the end so the kiosk can reach only the servers it needs?

Deny outbound traffic to ALL destinations on ALL ports

Deny inbound traffic from the catalog server

Allow inbound traffic on ALL ports

Allow outbound traffic to ALL destinations on ALL ports

A company is writing its password policy. Which of the following would most likely appear in it?

A ban on reusing previous passwords

A schedule for applying patches

A process for requesting new software

A list of websites employees may not visit

AP® Cybersecurity 4.3 Protecting Devices: Policies, Anti-Malware, Patches, Host Firewalls

1. Managerial controls for devices (4.3.A)

Policy	What it may include
Acceptable use policy 4.3.A.1	Blocking specific websites or types (social media, gaming); requiring software to stay updated; allowing peripheral devices; prohibiting external drives or media
Password policy 4.3.A.2	Minimum or maximum length; minimum or maximum time to keep a password; no reuse; construction rules (no dictionary words, character sets); using a password manager instead of writing passwords down
Software installation policy 4.3.A.3	Prohibiting users from installing software; a process to request software needed for a role; a list of approved software

2. Anti-malware software (4.3.B)

Anti-malware software (sometimes called antivirus) has tools to quarantine and remove malware that can corrupt, spy on or destroy a system. Malware contains indicators that make it detectable, called signatures 4.3.B.1. The software keeps a database of signatures, periodically scans the device’s files, and quarantines and removes any file that matches 4.3.B.2.

Anti-malware · scheduled scan

Scanned 48,212 files   Signatures updated: today 06:00
C:\Users\Public\Downloads\invoice_scan.pdf.exe
  Match: Trojan.Agent (signature 7741)   Action: quarantined
1 threat found · 1 quarantined · 0 removed pending

3. Updates and patches (4.3.C)

When a vulnerability is found in an operating system or software, the vendor fixes it and sends an update; a small update is called a patch 4.3.C.1. Keeping the operating system and applications on the newest version stops adversaries from exploiting known vulnerabilities 4.3.C.2.

4. Host-based firewalls (4.3.D)

A host-based firewall allows or denies traffic into or out of a single device, adding a layer of protection if the device is on a compromised network 4.3.D.1.
It is software on the device that follows an access control list (ACL): rules applied in order, first match wins, just like a network firewall 4.3.D.2.
It can also block specified outbound traffic, and should block every port or service the device does not need 4.3.D.3. For example, a library catalog kiosk might allow outbound traffic only to the catalog server and the update server, and deny everything else.
Rules can allow or deny by source or destination port or internet protocol (IP) address, service, protocol or application 4.3.D.4.

Audit a laptop’s host-based firewall below.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

Three device policiesUse, password, install: what you may do, how you sign in, what you may add.
Anti-malwareA most-wanted list: scan, match a signature, quarantine, remove.
Host-based firewallA bodyguard for one device, checking who comes in and what goes out, top rule first.

Common misconceptions

"A host-based firewall is pointless if the network already has one."
Not quite. It adds a layer for when the device sits on a compromised network, and it can block outbound traffic from that one device.
"Anti-malware catches every threat."
Not quite. It matches files against known signatures, so its database must stay updated and it can miss brand-new malware.
"Firewalls only control traffic coming in."
Not quite. A host-based firewall can also block specified outbound traffic, which helps stop an adversary sending stolen data out.

Exam traps

A policy is a managerial control even when it is about devices; anti-malware, patches and host-based firewalls are technical controls.
Host-based firewall rules work like network firewall rules: in order, first match wins. Blocking ports or services the device does not need is the default stance.
A patch fixes a known vulnerability. An unpatched device is exactly what an exploit for that known vulnerability targets.

By the numbers

Say each list out loud, then tap to check.

3 device policies Say them, then tap

4 things anti-malware does (as listed here) Say them, then tap

keep a signature database
scan files
match a signature
quarantine and remove

4 host firewall facts Say them, then tap

controls one device
rules in order (first match)
can block outbound traffic
block ports or services not needed

In 30 seconds

Acceptable use policy: what users may, may not and must do on organization devices. Password policy: length, age, reuse, construction rules, use a password manager. Software installation policy: what may be installed and how to request more.
Anti-malware scans files against a database of signatures and quarantines and removes matches.
Vendors fix vulnerabilities with updates; a small update is a patch. Staying current blocks exploits of known vulnerabilities.
A host-based firewall filters traffic into and out of one device with an ordered ACL, by port, IP address, service, protocol or application.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Rule	Action	Source	Port	Protocol
1	Allow	ALL	ALL	ALL
2	Deny	ALL	3389	TCP
3	Deny	ALL	ALL	ALL

Rule	Action	Destination	Port	Service
1	Allow	10.6.0.20 (catalog server)	443	HTTPS
2	Allow	10.6.0.30 (update server)	443	HTTPS
3	?	?	?	?

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Acceptable use policytap to flip

A managerial control describing what users may, may not and must do on organization devices.
Example and CED codes
Password policytap to flip

A managerial control setting password requirements: length, age, reuse, construction rules and password managers.
Example and CED codes
Software installation policytap to flip

A managerial control stating what software users may install, with an approved list and a request process.
Example and CED codes
Anti-malware softwaretap to flip

Software that scans files against a database of malware signatures and quarantines and removes matches.
Example and CED codes
Signaturetap to flip

An indicator in malware that makes it detectable; anti-malware and signature-based tools match against databases of them.
Example and CED codes
Patchtap to flip

A small software update from a vendor that fixes a known vulnerability.
Example and CED codes
Host-based firewalltap to flip

Software on a single device that allows or denies traffic into or out of it using an ordered set of rules.
Example and CED codes
Access control list (ACL)tap to flip

The ordered set of rules a firewall uses to permit or deny inbound and outbound traffic; the first matching rule is executed.
Example and CED codes

Questions students ask

What does an acceptable use policy include?

The activities that are permitted, prohibited or required on organization devices, for example blocking certain websites, requiring updates, allowing peripheral devices and prohibiting external drives.

How does anti-malware software find malware?

It keeps a database of malware signatures, periodically scans the device's files for matches, and quarantines and removes any match.

What is a host-based firewall?

Software on a single device that allows or denies traffic into or out of that device using an ordered set of rules, adding protection if the device is on a compromised network.

4.3 Protecting Devices