Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

A security technician conducts an assessment of an embedded building control device connected to an enterprise network. A vulnerability scan produces the following finding:

Host: 192.168.4.12
Port: 8080/tcp (HTTP)
Finding: Embedded Web Interface Hardcoded Credentials
Risk Level: High
Description: The device firmware contains fixed administrative credentials transmitted in cleartext over HTTP. No vendor security patches are available.

The legacy device must remain operational for business operations. Which of the following architecture-level mitigations is the BEST solution to protect the enterprise from this host vulnerability?

  1. Place the embedded device onto an isolated management VLAN accessible only via an encrypted jump host with strict access controls.Answer
  2. B
    Deploy a web application firewall rule targeting SQL injection and cross-site scripting vectors on HTTP port 8080.
  3. C
    Reconfigure the perimeter firewall to implicitly trust internal subnet traffic while filtering external incoming HTTP requests.
  4. D
    Install a detective intrusion detection system sensor on the local switch segment to issue alerts whenever unauthorized HTTP sessions occur.

Answer

Placing the embedded device onto an isolated management VLAN accessible only via an encrypted jump host with strict access controls is the best mitigation.
Placing unpatchable legacy embedded devices onto an isolated management VLAN and requiring access through an encrypted jump host isolates the host vulnerability, prevents cleartext exposure over general networks, and restricts access strictly to authenticated administrators.

Step-by-Step Solution

1
Analyze the vulnerability scan report and constraints.
Identified an unpatchable embedded host vulnerability involving hardcoded credentials and cleartext administrative HTTP access on port 8080.
Because the vendor offers no patches, host-level remediation is impossible, requiring network architecture mitigations.
2
Evaluate compensating security controls for unpatchable legacy systems.
Microsegmentation and out-of-band management restrict access to authorized administrators only.
Isolating legacy hosts behind strict VLAN segmentation and encrypted jump hosts reduces the attack surface and prevents unauthorized lateral access.

Key Concept

Host and Architecture Vulnerabilities Mitigation via Network Segmentation
Estimated Time:1m 30s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities