Question 1:- assuming the polling interval is acceptable, is this a strong enough defense? Could the malicious code fool the polling code?
No, its not a strong enough defense. Yes, the malicious code can identify the polling server/service by its IP, User Agent etc. and serve the clean file to your polling agent while continue to serve malicious files to others. Sure, you can try to prevent detection by changing IPs and User Agents of your agent regularly, but so can the malicious code adapt to detect your change.
While serving different content based on client is it in itself a trivial thing to do, the fact that the attacker knows that such a safeguard is in place is non-trivial (its more like a security through obscurity). The way an attacker can know about such a safeguard is when he knows your architecture (internal threat) or if you go through the compromise->fix->compromise cycles enough times for him to narrow down the cause of compromise detection.
Question 2:- Is there a better way to reduce the window of risk other than reducing the polling interval, which creates unnecessary traffic.
The better way to reduce the risk is to have defense in depth:
- Have host based file integrity tools like tripwire to watch the files in question.
- Defeating this defense will require host compromise
- Depending on how sensitive the files are and your paranoia level, configure your deployment tools to rebuild your files every n hours.
- Defeating this defense will require a network compromise.
- Remote monitoring of your files as you described.
- Defeating this defense will require 1.) either compromise of remote machine or 2.) enough knowledge/reconnaissance of your system.
- Deploy host based intrusion detection/prevention tools like snort, fail2ban, denyhosts to detect intrusion.
- Defeating this defense will require an attack which doesn't create a lot of noise in log files and/or evades signature based detection eg. application layer flaws.
- Deploy a web application firewall eg. ModSecurity to detect application level anomalies.
- Defeating this will require an lower level attack which should ideally get detected in the aforementioned point.
Even having all the measures above cannot guarantee security, however they reduce a lot of attack surface and make a successful and undetected compromise difficult.