A small office wants to reduce the risk of malware arriving through email and malicious websites while keeping administration simple. Which two measures provide the strongest protection against these threats? (Choose two.)
Trap 1: Share a single administrator account among all staff so everyone…
Shared administrator accounts destroy accountability because actions cannot be attributed to an individual, and they grant excessive privileges that malware can abuse when any one user is compromised. Least privilege with individual named accounts is the correct approach, so this measure worsens rather than improves the security posture.
Trap 2: Disable automatic operating system updates to prevent unexpected…
Disabling automatic updates leaves known vulnerabilities unpatched, and malicious websites routinely exploit unpatched browsers and plugins to install malware. This measure increases risk rather than reducing it, and the reboot inconvenience is normally handled with maintenance windows instead of turning off patching entirely.
Trap 3: Allow all outbound traffic from the internal network to simplify…
Permitting every outbound connection lets infected hosts contact command-and-control servers and exfiltrate data, and it removes any chance of blocking malicious destinations at the perimeter. This is a permissive posture that enlarges the attack surface instead of protecting against email and web threats.
- A
Install and regularly update endpoint antivirus and anti-malware software on all workstations.
Endpoint protection detects and blocks known malicious files and behaviors on the host itself, which is the last line of defense if a dangerous attachment or download slips past other controls. Regular signature and engine updates are essential because new malware variants appear constantly, so this directly addresses the stated risk with modest administrative effort.
- B
Share a single administrator account among all staff so everyone can fix problems quickly.
Why it fails: Shared administrator accounts destroy accountability because actions cannot be attributed to an individual, and they grant excessive privileges that malware can abuse when any one user is compromised. Least privilege with individual named accounts is the correct approach, so this measure worsens rather than improves the security posture.
- C
Disable automatic operating system updates to prevent unexpected reboots.
Why it fails: Disabling automatic updates leaves known vulnerabilities unpatched, and malicious websites routinely exploit unpatched browsers and plugins to install malware. This measure increases risk rather than reducing it, and the reboot inconvenience is normally handled with maintenance windows instead of turning off patching entirely.
- D
Deploy a secure web gateway or DNS filtering service that blocks known malicious domains.
Blocking resolution or connection to known malicious domains stops users from reaching drive-by download and phishing sites before any payload is delivered. It complements endpoint protection by cutting off the delivery channel, and cloud-based filtering requires little on-site administration, matching the small office constraint.
- E
Allow all outbound traffic from the internal network to simplify troubleshooting.
Why it fails: Permitting every outbound connection lets infected hosts contact command-and-control servers and exfiltrate data, and it removes any chance of blocking malicious destinations at the perimeter. This is a permissive posture that enlarges the attack surface instead of protecting against email and web threats.