4.5 Enhancing enterprise security explained

Objective 4.5 is a scenario objective about adjusting existing controls to meet a new need. Questions describe a problem and ask which change to make, so you need to know what each capability does well.

Firewalls are changed through rules, access lists, and the ports and protocols they allow. Screened subnets hold public-facing services. Intrusion detection and prevention systems rely on signatures for known attacks and trend analysis for unusual patterns. Web filtering can run as an agent on each device (which works off the corporate network) or centrally through a proxy, using URL scanning, content categorisation, block rules and reputation. DNS filtering stops devices from resolving known malicious domains, whatever application makes the request.

Operating system security includes Group Policy for pushing settings across a Windows domain and SELinux for mandatory access control on Linux, which confines a process to its policy regardless of file ownership. Implementing secure protocols means choosing encrypted versions (SSH, SFTP, HTTPS, LDAPS), the right ports and transport method.

Email security is a common exam theme. SPF publishes which servers may send mail for your domain. DKIM signs messages so receivers can check they weren't altered and came from an authorised sender. DMARC tells receivers what to do when a message fails those checks: none, quarantine or reject. A mail gateway filters messages before delivery.

File integrity monitoring alerts when a critical file changes. Data loss prevention detects and blocks sensitive data leaving, whether by email, upload or USB. Network access control decides whether a device may join the network, often after a posture check confirms patches and antivirus are current. Endpoint detection and response records behaviour on each host and lets analysts investigate and isolate it; extended detection and response adds data from network, email, cloud and identity. User behaviour analytics learns normal patterns for each user and flags sharp changes, which helps find compromised accounts and insiders.

When you answer, find the gap the scenario describes and choose the capability built to close it. Spoofed email from your own domain: SPF, DKIM and DMARC. Unexpected changes to system binaries: file integrity monitoring. Unpatched laptops joining the network: NAC with posture assessment. Laptops off-network still need filtering: agent-based web filtering.