Examkin

Question

Difficulty: HardHost, Network, and Architecture Vulnerabilities

A security analyst is performing a comprehensive assessment across an enterprise environment. Match each host, network, or infrastructure vulnerability scenario observed during the assessment to its corresponding vulnerability category.

  • A web application proxy hosted on a cloud server allows external requests to fetch internal resources, enabling unauthorized retrieval of IAM role credentials from http://169.254.169.254.Cloud Instance Metadata Service (IMDS) Exposure
  • An internal operational technology (OT) host on an industrial network crashes regularly because an application repeatedly requests dynamic heap memory without releasing unused memory blocks.Host Resource Exhaustion via Memory Leak
  • An enterprise network switch maintains an unencrypted management interface exposing cleartext administrative credentials and allowing unauthenticated firmware updates.Insecure Embedded System Management Interface
  • An internal database server containing sensitive employee records is reachable directly from the corporate Wi-Fi subnet without any intervening firewall or access control restrictions.Missing Network Segmentation and Microsegmentation Controls

Answer

Each scenario maps directly to its underlying architectural or host vulnerability: 1) Cloud proxy credential access maps to Cloud Instance Metadata Service (IMDS) Exposure; 2) Application memory failure maps to Host Resource Exhaustion via Memory Leak; 3) Unencrypted switch management maps to Insecure Embedded System Management Interface; 4) Unrestricted database access from Wi-Fi maps to Missing Network Segmentation and Microsegmentation Controls.
Each scenario correctly isolates a distinct domain of host and network vulnerabilities. Cloud metadata endpoints (169.254.169.254) reflect cloud architecture host vulnerabilities; memory management bugs lead to host resource exhaustion; legacy/unencrypted switch interfaces represent embedded management vulnerabilities; and unrestricted inter-subnet access highlights network architecture segmentation deficiencies.

Step-by-Step Solution

1
Analyze the cloud proxy scenario
Identified the IP address 169.254.169.254 as the link-local address for cloud instance metadata services
Requesting metadata via an exposed application proxy exposes internal role credentials through IMDS vulnerability.
2
Analyze the OT application crash scenario
Identified unreleased dynamic heap allocations causing system instability
Failure to release allocated memory constitutes a memory leak leading to host resource exhaustion.
3
Analyze the enterprise network switch scenario
Identified unencrypted management interfaces and unauthenticated firmware options
Network appliances and hardware management consoles with insecure communication protocols suffer from insecure embedded management interfaces.
4
Analyze the database network path scenario
Identified direct connectivity from wireless user subnets to sensitive database servers
Lack of network boundaries between standard client subnets and critical host assets indicates missing network segmentation.

Key Concept

Classification and identification of host, network, and cloud infrastructure vulnerabilities.
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities