18. A security administrator needs a method to secure data in an environment that includes some form of checks so that the administrator can track any changes. Which of the following should the administrator set up to achieve this goal?
Answer: D
File Integrity Monitoring (FIM) should be set up to secure data and track changes.
Implementing File Integrity Monitoring (FIM) allows the security administrator to secure data effectively while providing the capability to track any changes made to that data.
A) SPF
Sender Policy Framework (SPF) is primarily used for email authentication to prevent spoofing. It does not provide any mechanisms for tracking changes or securing data within a system, making it unsuitable for the administrator's needs.
B) GPO
Group Policy Objects (GPO) are used in Windows environments to manage and configure operating system settings for users and computers. While GPO can enforce policies to some extent, it does not specifically track data changes or secure data, which is critical for the administrator’s objective.
C) NAC
Network Access Control (NAC) is designed to enforce security policies on devices trying to access a network. While it helps in securing network access, it does not monitor or secure data changes directly, thus failing to meet the requirements outlined in the question.
D) FIM
File Integrity Monitoring (FIM) is designed to monitor and track changes to files and data within a system. It alerts administrators to any unauthorized changes, making it the most appropriate choice for securing data while providing a method for tracking modifications.
Conclusion
File Integrity Monitoring (FIM) is the definitive choice for the administrator’s needs as it not only secures data but also enables ongoing monitoring and tracking of changes. Other options, such as SPF, GPO, and NAC, do not offer the required capabilities for managing and auditing data integrity, thereby failing to fulfill the specified goal.