An analyst discovers that internal workstations can initiate connections to any external IP on port 80 and 443 without restriction. Which control would most improve the defensibility of this architecture?
Select an answer to reveal the explanation.
Short Explanation
Unrestricted outbound web access gives attackers an easy path for command-and-control and data exfiltration. You need a control that inspects and filters outbound HTTP/HTTPS, so an explicit proxy or DNS-based web filtering solution is the best fit.
Full Explanation
The correct control is an explicit-proxy or DNS-based web filtering solution because unrestricted outbound web access is a primary command-and-control and data-exfiltration path. Such a solution provides URL categorization, SSL inspection, and reputation blocking, which actively reduces the attack surface rather than merely observing traffic. The option that deploys an IDS in passive mode on the egress interface is wrong because passive IDS detects but does not block malicious outbound traffic. The option that adds a DENY any rule at the bottom of the firewall ruleset is wrong because a default-deny rule at the bottom of a top-down ruleset has no effect if an ALLOW all rule already exists higher in the list. The option that increases logging verbosity on internal switches is wrong because verbose logging helps with detection but does not reduce the attack surface.