An analyst discovers that internal workstations can initiate connections to any external IP on port 80 and 443 without restriction. Which control would most improve the defensibility of this architecture?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because unrestricted outbound web access is a primary C2 and data-exfiltration path; a proxy or DNS filtering solution provides URL categorization, SSL inspection, and reputation blocking — actively reducing attack surface. A is wrong because passive IDS detects but does not block malicious outbound traffic.
Full explanation below image
Full Explanation
B is correct because unrestricted outbound web access is a primary C2 and data-exfiltration path; a proxy or DNS filtering solution provides URL categorization, SSL inspection, and reputation blocking — actively reducing attack surface. A is wrong because passive IDS detects but does not block malicious outbound traffic. C is wrong because a default-deny rule at the bottom of a top-down ruleset has no effect if an ALLOW all rule already exists higher in the list. D is wrong because verbose logging helps with detection but does not reduce the attack surface.