Exam ZDTA Topic 5 Question 18 Discussion

A watering-hole attack compromises a legitimate website or service that the intended victims already trust and commonly visit. The attacker plants malicious active content, such as injected JavaScript or exploit code, so users are infected during normal browsing instead of being lured to an obviously suspicious site. The answer is Option B (Block Suspected phishing sites) because it specifically describes malware hosted on a commonly accessed service, which is the defining trait of this attack type.
Why the other options are incorrect:
A). Configure Advanced Cloud Sandbox policies: Cloud Sandbox detonates and observes suspicious files to identify unknown or advanced malware behavior.
C). Enable Watering Hole detection: A watering-hole attack compromises a legitimate site or service that the victims commonly use.
D). Block Windows executable files from uncategorized websites: Blocking Windows executables from uncategorized sites is a file-type policy example. It is not the forwarding or connector behavior in this question.