39. A security analyst is identifying vulnerabilities in laptops. Users often take their laptops out of the office while traveling, and the vulnerability scan metrics are inaccurate. Which of the following changes should the analyst propose to reduce the MTTD to fewer than four days?
Answer: A
Deploying agents to all endpoints to scan daily for vulnerabilities will reduce the MTTD.
Implementing agents on all endpoints allows for continuous monitoring and daily scanning of vulnerabilities, ensuring timely detection and response to security issues even when laptops are taken off-site.
A) Deploy agents to all endpoints to scan daily for vulnerabilities.
This option is correct because deploying agents provides real-time monitoring and automated daily scans of vulnerabilities. This proactive approach facilitates rapid detection and remediation of vulnerabilities, significantly reducing the Mean Time to Detect (MTTD) to fewer than four days.
B) Configure the network vulnerability scan job to use credentials.
While using credentials can enhance the depth of vulnerability scans, it does not address the issue of laptops being frequently off-network. This method may lead to missed detections when devices are not connected to the corporate network, failing to effectively reduce the MTTD.
C) Change the vulnerability scanner configuration to perform network scans more than once per day.
Increasing the frequency of network scans can be beneficial, but it may not effectively capture vulnerabilities on laptops that are outside the network. Without continuous monitoring through agents, many devices may remain unscanned, keeping the MTTD high.
D) Increase the scan maximum running time to four days to wait for missing endpoints.
Extending the scan duration to four days does not inherently improve the detection of vulnerabilities; it simply prolongs the waiting period for results. This approach risks delaying the identification of critical vulnerabilities and does not actively reduce the MTTD.
Conclusion
The most effective strategy to ensure vulnerabilities are detected promptly is to deploy agents for daily scans on all endpoints. This method directly addresses the challenges posed by off-network usage and ensures that vulnerabilities are identified in a timely manner, unlike the other options which either do not address the core issue or may prolong detection times.