A Windows endpoint protection team wants to prevent macro execution in Microsoft Office documents delivered via email. Which combination of controls provides defense in depth for this threat?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because layered controls address the threat at multiple points: GPO/MOTW disables macros in externally sourced files, ASR rules prevent Office from spawning malicious child processes (cmd.exe, wscript.exe), and email gateway filtering stops macro-enabled files before delivery. A is wrong because AV signature detection alone is bypassed by obfuscated or novel macro code.
Full explanation below image
Full Explanation
B is correct because layered controls address the threat at multiple points: GPO/MOTW disables macros in externally sourced files, ASR rules prevent Office from spawning malicious child processes (cmd.exe, wscript.exe), and email gateway filtering stops macro-enabled files before delivery. A is wrong because AV signature detection alone is bypassed by obfuscated or novel macro code. C is wrong because blocking all attachments is operationally unacceptable for most organizations. D is wrong because user training alone is insufficient; humans are successfully phished even with training, especially under social engineering pressure.