Examkin

Question

Difficulty: Very hardKey Security Concepts, Threats, Vulnerabilities, and Mitigations

A network security architect is reviewing the organization's defense-in-depth posture following a risk assessment. Match each enterprise security threat scenario on the left with its most appropriate primary mitigation control on the right.

  • An external attacker sends high volumes of UDP traffic with forged source IP addresses to exposed NTP servers to overwhelm enterprise edge routers.Deploy Control Plane Policing (CoPP) and restrict open NTP server query access.
  • An attacker sets up a proxy server mimicking a legitimate login portal to capture session cookies and bypass standard SMS-based two-factor authentication.Enforce FIDO2/WebAuthn hardware key authentication bound to the domain origin.
  • A malicious insider connects an unauthorized laptop to a dynamic switch port and floods the switch with generated MAC addresses to capture unencrypted traffic.Implement Port Security with restricted MAC limits and dynamic MAC learning controls.
  • An automated botnet attempts a low-and-slow execution of common passwords against hundreds of user accounts to evade traditional lockout rules.Enforce risk-based smart lockout policies and mandatory credential-pair anomaly detection.

Answer

NTP UDP amplification pairs with Control Plane Policing and NTP query restrictions; Adversary-in-the-Middle phishing pairs with FIDO2/WebAuthn domain-bound hardware key authentication; CAM table MAC flooding pairs with Port Security MAC limits; Password spraying across multiple accounts pairs with risk-based smart lockout policies.
Each security threat scenario directly maps to its precise technological defense: NTP amplification relies on CoPP and NTP service hardening; AiTM phishing proxies require FIDO2 domain binding; switch CAM flooding requires Port Security limits; and password spraying requires tenant-wide risk-based lockout controls.

Step-by-Step Solution

1
Analyze threat scenario 1 (NTP UDP traffic with spoofed IPs).
Identified as a Distributed Denial of Service (DDoS) reflection/amplification attack targeting network control planes.
Control Plane Policing (CoPP) rate-limits incoming control plane traffic and restricting open NTP query access prevents amplification.
2
Analyze threat scenario 2 (Proxy capturing session cookies and SMS 2FA).
Identified as an Adversary-in-the-Middle (AiTM) phishing attack targeting authentication mechanisms.
Phishing-resistant authentication protocols such as FIDO2/WebAuthn use origin-bound public key cryptography that fails if the domain name in the browser does not match.
3
Analyze threat scenario 3 (Flooding dynamic switch ports with generated MAC addresses).
Identified as a Layer 2 CAM table overflow/MAC flooding attack.
Port Security enforces maximum MAC address limits per access port, preventing switch CAM table exhaustion and fail-open behaviors.
4
Analyze threat scenario 4 (Low-and-slow execution of common passwords across many accounts).
Identified as a password spraying attack.
Traditional account lockout triggers per-user failure limits; smart/risk-based lockout policies evaluate tenant-wide password attempt patterns to block spraying.

Key Concept

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Rate this question

Topics

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

More questions from this topic