Implementing Application Permit Listing to Prevent Malware
Short answer
D The company should implement permit listing (allowlisting) to ensure only pre-approved applications are allowed to run, blocking all others by default.
Question
Key Takeaways
The question tests the distinction between signature-based defenses and allowlist mechanisms; the key trap is choosing broader technologies like HIPS when the specific policy of 'permit listing' is the direct answer.
Learn how permit listing (allowlisting) prevents malware by restricting system access to only authorized applications, addressing risks from unauthorized user installs.
Common mistake: Candidates often select HIPS because it sounds like a comprehensive host defense, but HIPS is a toolset, whereas permit listing is the specific configuration method required to strictly allow only authorized apps as described.
Expert Analysis
The scenario describes a security posture where the organization has shifted from a reactive stance to a proactive, strict enforcement model. The core requirement is to prevent unauthorized applications from executing on systems where users previously installed software without permission.
The correct mechanism for this specific control is Permit listing (also known as allowlisting). Unlike traditional antivirus or signature-based detection, which relies on knowing what bad looks like, permit listing operates on a default-deny principle. It only allows execution of applications that have been explicitly approved by the administrator. This directly addresses the root cause: users installing their own, potentially malicious, applications.
While HIPS (Host-based Intrusion Prevention System) can enforce application controls, it is a broader category of technology that includes behavior blocking and network protection. Permit listing is the specific method or policy described in the option that achieves the goal of allowing only authorized apps. Signing ensures integrity but does not restrict execution if the signed app is unapproved. Access control generally refers to user permissions rather than application execution policies. Therefore, implementing an application permit list is the precise solution to stop unapproved installs.
Exam Strategy
When a scenario emphasizes 'only allowed' or 'pre-approved' items, look for allowlist/permit list options. Differentiate between the tool (like HIPS) and the specific policy mechanism (like permit listing) being tested. Focus on the default-deny nature of the solution.
Frequently Asked Questions
What is the difference between permit listing and block listing?
Why isn't Signing the correct answer here?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
jamestkd 👍 1 Answered DPermit listing—more commonly known as allowlisting or whitelist filtering—is a cybersecurity strategy that explicitly allows only pre-approved applications, IP addresses, users, or devices to access a network, system, or application, while blocking everything else by default.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →