A security incident responder discovers an attacker has gained access to a network and has overwritten key system files with backdoor software. The server was reimaged and patched offline. Which of the following tools should be implemented to detect similar attacks?
A) Vulnerability scanner
B) TPM
C) Host-based firewall
D) File integrity monitor
E) NIPS

Question

Quizplus · Accepted Answer

A File Integrity Monitor (FIM) is designed to detect changes to critical system files, which would help identify unauthorized modifications like those made by backdoor software.

A Security Incident Responder Discovers an Attacker Has Gained Access