The STIGS contain technical guidance to 'lock down' information systems/software that might otherwise be vulnerable to a malicious computer attack.

• A. Data integrity checks.
• B. Malicious computer attack.
• C. Routine software updates.
• D. User training programs.

Answer: (B)

STIGs are about hardening information systems to reduce their exposure to attackers. The statement focuses on locking down systems that could be vulnerable to a malicious computer attack, so the threat being mitigated is the attacker’s attempt to compromise the system. That’s why this option is the best fit: it targets the overall purpose of the guidance—protecting against malicious exploitation.

Data integrity checks describe a control that verifies data accuracy, which is part of security but doesn’t capture the specific aim of reducing vulnerability to attacks. Routine software updates and user training are important security practices, but they are methods or enablers of security rather than the primary description of what the STIG guidance is designed to defend against.