Certified Incident Handler (CIH) Practice Ecam

What practice helps an incident responder eradicate directory traversal attacks?

1. Restrict file permissions

2. Segment the OS and sensitive application files

3. Use secure coding practices

4. Implement strong firewall rules

The correct answer is: Segment the OS and sensitive application files

The practice that helps an incident responder eradicate directory traversal attacks is primarily reliant on flexible permissions and access control mechanisms rather than OS segmentation alone. Restricting file permissions directly addresses the core of directory traversal vulnerabilities. By ensuring that files and directories have the appropriate permissions set, the attacker's ability to navigate directories outside of the intended file structure is minimized. Restricting permissions helps ensure that users or processes can only access the files they are explicitly allowed to interact with, making it difficult for unauthorized access or traversal to occur. It fortifies the system by limiting what can be accessed or manipulated, thereby creating a robust line of defense against potential exploits targeting directory structure weaknesses. Though segmenting the OS and sensitive application files can contribute to overall security, it does not specifically counteract directory traversal attacks in a direct manner. Similarly, secure coding practices and firewall rules are important elements of a comprehensive security posture but do not directly target the underlying permissions issues that often lead to such vulnerabilities.