問題文
A security review maps each platform capability to the step of an attack it interrupts. An attacker who has reached an administrative account is trying to destroy the backups so that a ransom becomes unavoidable. Which capability interrupts that specific step?
選択肢
- A report of the posture of the cluster, because the account is left without a path to change the settings that the report has already recorded as compliant.
- A classification of the stored copies by sensitivity, because the account is left without a path to reach the objects that the classification marked as regulated.
- A lock of a stated period on the copies, because the account is left without a way to remove the locked objects before the period that was set on them has elapsed.
- A scan of the stored copies against threat information, because the account is left without a path to introduce a file which the current indicators already describe.