問題文
A requirement says: record every attempt by a program on this workstation to reach an external address, including the name of the program, and refuse the attempt when the destination is not on the approved list. Which endpoint capability satisfies both halves?
選択肢
- Host-based intrusion detection, because a capability that watches files, settings, and process behavior necessarily observes the connections those processes open and can therefore refuse the ones whose destination is not approved as part of the same evaluation.
- Antimalware, which scans what each program downloads and refuses the ones whose source is not on the approved list.
- A host firewall, because it can decide on outgoing connections and record the program that attempted each one.
- A web content filter at the boundary, which records the name of every program that reaches an address outside the office.