A security analyst received a series of antivirus alerts from a workstation segment, and users reported ransomware messages. During lessons-learned activities, the analyst determines the antivirus was able to alert to abnormal behavior but did not stop this newest variant of ransomware. Which of the following actions should be taken to BEST mitigate the effects of this type of threat in the future?
A) Enabling sandboxing technology
B) Purchasing cyber insurance
C) Enabling application blacklisting
D) Installing a firewall between the workstations and Internet

Question

Quizplus · Accepted Answer

Enabling sandboxing technology allows suspicious files to be executed in a controlled environment, helping to detect and prevent new variants of malware like ransomware before they can cause harm.

A Security Analyst Received a Series of Antivirus Alerts from a Workstation