Examkin

Question

Difficulty: Very hardHost, Network, and Architecture Vulnerabilities

A security analyst evaluates an operational technology (OT) network segment and captures the following service enumeration and vulnerability assessment report for an embedded field controller:

Nmap scan report for 192.168.50.14 (HVAC Controller)
PORT STATE SERVICE VERSION
161/udp open snmp SNMPv1 (public community string enabled)
22/tcp open ssh OpenSSH 4.3 (Linux kernel 2.6.18 - vendor status: End-of-Life)
Host Assessment Alert: Kernel memory corruption vulnerability identified (No vendor patch available).

Based on the report, which of the following specific host and network vulnerabilities are directly present on this controller? (Select TWO.)

  1. Transmission of cleartext management traffic across the network using an insecure protocol versionAnswer
  2. Presence of unsupported end-of-life (EOL) operating software that receives no official vendor security patchesAnswer
  3. C
    Client-side cross-site scripting exposure permitting arbitrary SQL database command injection
  4. D
    Misclassification of a detective intrusion detection system as a preventive inline firewall control
  5. E
    Implicit reliance on boundary perimeter defenses due to complete internal network segment trust

Answer

The host and network vulnerabilities directly present are the transmission of cleartext management traffic using an insecure protocol version (SNMPv1) and the presence of unsupported end-of-life (EOL) operating software.
The scan report explicitly documents two distinct flaws: 1) SNMPv1 running on port 161/udp, which is a legacy protocol that transmits management traffic and community strings in unencrypted cleartext; and 2) a Linux 2.6.18 kernel marked as End-of-Life (EOL), indicating that the operating system vendor no longer provides security patches for discovered host memory corruption vulnerabilities.

Step-by-Step Solution

1
Analyze the service enumeration for port 161/udp.
Identified SNMPv1 running with a default public community string, which lacks cryptographic encryption and authentication capabilities.
SNMPv1 transmits community strings and data in cleartext, exposing management information to network sniffing.
2
Analyze the host operating system status from the vulnerability alert and SSH service version.
Identified Linux kernel 2.6.18 designated as End-of-Life with unpatched memory corruption issues.
EOL systems no longer receive security updates from vendors, leaving known host vulnerabilities permanently unpatched.
3
Evaluate distractors against empirical log data.
Eliminated web vulnerability mismatches, control type misclassifications, and non-log-supported network architectural assumptions.
Distractors refer to unrelated web attacks or security control definitions not substantiated by the provided scan output.

Key Concept

Host and Network Vulnerability Identification
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities