A company had a recent data leak incident. A security engineer investigating the incident discovered that a malicious link was accessed by multiple…

The described attack involves two primary stages: the delivery of the threat via a phishing email and the execution of a payload (backdoor) on the endpoint. A layered security approach is required. A secure email gateway (B) acts as the first line of defense, inspecting incoming emails to detect and block phishing attempts and malicious links before they reach the user. Should this layer be bypassed, endpoint detection and response (A) provides the critical next layer of defense. It monitors the endpoint (the macOS system) for suspicious behavior, such as the installation and execution of a backdoor, and enables security teams to contain and remediate the threat directly on the compromised machine.

C. data loss prevention: This is a reactive control for this scenario; it aims to prevent data exfiltration after a compromise has already occurred, rather than preventing the attack itself.
D. intrusion prevention system: An IPS operates at the network level and may not have visibility into endpoint-specific activities or encrypted command-and-control traffic, making it less effective than EDR here.
E. web application firewall: A WAF protects a company's web servers and applications from attack, which is irrelevant as the attack targeted employee client endpoints.

1. Cisco Secure Email Gateway Data Sheet. Cisco. (2023). "Cisco Secure Email Gateway is your first line of defense against the constant barrage of email-based threats, such as phishing, business email compromise, ransomware, and spam." This document establishes the role of an SEG in preventing the initial attack vector. (Reference: Document ID EDCS-15264499, Page 1, "Product overview").

2. Cisco Secure Endpoint Data Sheet. Cisco. (2023). "Cisco® Secure Endpoint... provides advanced endpoint protection... along with endpoint detection and response (EDR). It prevents breaches, blocks malware at the point of entry, and rapidly detects, contains, and remediates advanced threats that evade front-line defenses." This source confirms EDR's role in stopping threats like backdoors on endpoints. (Reference: Document ID C22-743737-11, Page 1, "Product overview").

3. MITRE ATT&CK® Framework. The attack described maps to ATT&CK tactics. Phishing (T1566) is the Initial Access technique, and a backdoor represents Persistence (e.g., T1573) or Command and Control (e.g., T1071). The recommended controls (SEG and EDR) directly map to mitigations for these specific techniques. (Reference: MITRE ATT&CK, Techniques T1566 and associated mitigations M1018 "User Training" and M1021 "Restrict Web-Based Content," which are functions of SEGs and endpoint controls).