Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

Match each enterprise host, network, or architecture vulnerability scenario to its primary mitigation strategy.

  • Unpatched buffer overflow vulnerability in legacy edge router firmwareImplement virtual patching via Network Intrusion Prevention System (NIPS) signatures
  • Plaintext management protocols (Telnet/HTTP) enabled across core network switchesDisable legacy services and enforce SSHv2 and HTTPS transport encryption
  • Flat network architecture allowing unrestricted communication between workstations and database serversRe-architect the infrastructure into segmented VLANs with firewall Access Control Lists (ACLs)
  • Critical operational technology (OT) host running an End-of-Life (EoL) operating systemIsolate the legacy system in a restricted network zone with strict microsegmentation

Answer

Unpatched router firmware buffer overflow matches with virtual patching via NIPS; Plaintext switch management protocols match with disabling legacy services and enforcing SSHv2/HTTPS; Flat network architecture matches with re-architecting into segmented VLANs with firewall ACLs; EoL OT operating system matches with isolating the host in a restricted network zone via microsegmentation.
Each vulnerability is paired with its appropriate architectural or technical control: virtual patching defends unpatched firmware via inline NIPS inspection; SSHv2/HTTPS eliminates plaintext credential interception; network segmentation prevents lateral movement in flat topologies; and network isolation mitigates the inherent exposure of unpatchable EoL hosts.

Step-by-Step Solution

1
Analyze the firmware buffer overflow vulnerability on the legacy edge router.
Identify that because immediate software patching or device replacement may be delayed, virtual patching via NIPS signatures provides inline mitigation.
Virtual patching intercepts attack vectors at the network layer without modifying firmware.
2
Evaluate the risk of plaintext management protocols (Telnet/HTTP) on core switches.
Determine that migrating to encrypted management standards (SSHv2 and HTTPS) protects credentials from interception.
Plaintext protocols transmit credentials unencrypted across the network.
3
Assess the security impact of a flat enterprise network topology.
Recognize that dividing the network into segmented VLANs with firewall ACLs restricts lateral movement between compromised end-user nodes and backend databases.
Flat networks lack internal boundaries, exposing internal servers to host compromises elsewhere on the subnet.
4
Determine the risk mitigation for an End-of-Life host operating system.
Apply microsegmentation to isolate the unpatchable legacy host from general enterprise traffic.
EoL systems cannot be patched against new vulnerabilities, so compensating controls must restrict network reachability.

Key Concept

Host, Network, and Architecture Vulnerability Mitigations
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities