An attacker embedded a macro within a word processing file opened by a user in an organization’s legal department. The attacker used this technique to gain access to confidential financial dat a. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

The attack vector is a malicious macro within a document, and the objective is unauthorized access to financial data. The most effective mitigations directly counter these actions.
1. Signed Macro Requirements (C): This is a primary preventative control. By configuring office applications to only execute macros that are digitally signed by a trusted publisher, the organization can block the execution of unauthorized, malicious code embedded in documents from unknown sources.
2. Controlled Folder Access (A): This is a crucial mitigating control. It is a feature that helps protect valuable data from malicious apps and threats, such as ransomware. It works by allowing only trusted applications to access protected folders. Even if a malicious macro executes, Controlled Folder Access would prevent it from accessing or modifying files in protected locations, thus thwarting the data theft attempt.

B. removable device restrictions: This control addresses a potential delivery vector but does not mitigate the threat if the malicious file arrives via another method, such as email.
D. firewall rules creation: Firewall rules manage network traffic. They would not prevent the local execution of a macro or its access to local files on the compromised machine.
E. network access control: NAC policies validate a device's security posture upon connecting to the network; they do not inspect file content or prevent a user from running a malicious macro on an already-compliant device.

1. Microsoft Corporation. (2023). Protect important folders with controlled folder access. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders. This document states, "Controlled folder access helps you protect valuable data from malicious apps and threats... It's especially useful in helping to protect against ransomware that attempts to encrypt your files and hold them hostage." This directly supports option A.

2. Microsoft Corporation. (2023). Use a digital signature to sign macros. Microsoft Support. Retrieved from https://support.microsoft.com/en-us/office/use-a-digital-signature-to-sign-macros-364b935a-3179-44de-86c1-3021e3828113. This official documentation explains how digital signatures for macros provide a "verifiable signature that attests to the authenticity and integrity of the macro," which is the basis for requiring signed macros as a security policy (Option C).

3. Santos, O., & Stuppi, J. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. Chapter 15, "Endpoint Security and Analysis," discusses host-based security controls. The principles of application whitelisting and controlling script execution align directly with requiring signed macros. The concept of host-based intrusion prevention systems (HIPS) protecting critical system files aligns with the functionality of Controlled Folder Access.