Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

Match each enterprise system hardening control to its primary technical mitigation objective.

  • Disabling Unused OS Services and Listening PortsMinimizes the host attack surface by closing unnecessary entry points accessible to network-based attackers.
  • Application Allowlisting (AppLocker / WDAC)Prevents unauthorized binaries, untrusted scripts, and unapproved software from running within the operating system environment.
  • Automated Centralized Patch ManagementRemoves known software flaws and mitigates publicly documented Common Vulnerabilities and Exposures (CVEs).
  • Unified Extensible Firmware Interface (UEFI) Secure BootEnsures root-of-trust integrity by preventing unauthorized bootloaders and kernel drivers from executing during system startup.

Answer

Disabling Unused OS Services matches minimizing the host attack surface; Application Allowlisting matches preventing unauthorized binaries from running; Automated Patch Management matches removing known software flaws (CVEs); and UEFI Secure Boot matches ensuring root-of-trust integrity during startup.
Each hardening control maps directly to its intended technical outcome: disabling services reduces exposed host attack surface, application allowlisting prevents unauthorized code execution, automated patch management fixes known security bugs (CVEs), and UEFI Secure Boot maintains cryptographic boot integrity against bootkits.

Step-by-Step Solution

1
Analyze host attack surface reduction controls.
Identify that turning off unneeded network services and ports eliminates potential avenues for remote exploitation.
Deactivating unused network endpoints directly minimizes host exposure.
2
Evaluate executable binary control mechanisms.
Connect application allowlisting with policies that enforce explicitly trusted executables and scripts.
Allowlisting prevents unauthorized binary execution even if malicious files are downloaded to disk.
3
Assess vulnerability lifecycle remediation.
Link automated patch deployment to addressing publicly reported vulnerabilities.
Patch management updates software binaries to resolve known coding defects (CVEs).
4
Examine pre-boot integrity verification controls.
Associate UEFI Secure Boot with verifying digital signatures of boot components prior to operating system initialization.
Secure Boot prevents rootkits and untrusted drivers from loading into memory before security software initializes.

Key Concept

Enterprise Host Hardening and Security Controls
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic