ISC2 CISSP Practice Question

The correct answer is application whitelisting. Application whitelisting operates on a default-deny principle where only specifically approved applications are allowed to run, making it extremely effective against malware, zero-day attacks, and unauthorized software. It prevents execution of unauthorized code, which is the foundation of most attacks.

While antivirus software is important, it relies primarily on signature-based detection which can miss new or modified threats. Full disk encryption protects data at rest but does not prevent malicious code execution. Host-based firewalls filter network traffic but don't prevent authorized applications from being exploited or running malicious code that doesn't require network access.

Application whitelisting provides superior protection by ensuring only trusted applications can execute, effectively blocking most attack vectors before they can cause damage, while maintaining reasonable system performance compared to behavioral analysis solutions that constantly monitor all system activities.