Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Workload Protection Platform (CWPP)Easy
A security engineer is configuring Prisma Cloud to monitor for unauthorized changes to critical system binaries on Linux hosts. They need to ensure that any modification to files like `/bin/bash` or `/usr/bin/sudo` triggers an immediate alert and is recorded for forensic analysis. Which Prisma Cloud feature should be primarily configured for this requirement?
- AVulnerability Management
- BCompliance Scanning
- CFile Integrity Monitoring (FIM)
- DBehavioral Anomaly Detection (BAD)
Show answer & explanationAnswer & explanation
Correct answer: C. File Integrity Monitoring (FIM)
File Integrity Monitoring (FIM) is specifically designed to detect and alert on unauthorized changes to critical files and directories. This directly addresses the requirement to monitor for modifications to system binaries.
Why the other options are wrong
- A. Vulnerability Management focuses on identifying known software flaws, not unauthorized file changes.
- B. Compliance Scanning checks configurations against security benchmarks, not real-time file changes.
- D. Behavioral Anomaly Detection (BAD) identifies unusual process or network activity, not specific file modifications.
File Integrity Monitoring (FIM)
A security control that monitors critical operating system and application files for unauthorized changes.
- Detects modifications, deletions, and additions to monitored files.
- Essential for maintaining system integrity and detecting tampering.
- Often used for compliance requirements like PCI DSS.
Memory trick: FIM is the 'Watchdog' for your critical files.