Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

A security analyst reviews a vulnerability assessment report for an internal application server host. The report contains the following network service scan snippet:

Host: 192.168.4.15
Port: 1099/TCP
Service: Java JMX RMI
Finding: Remote JMX agent accepting unauthenticated connections. Anonymous users can register MBeans and execute arbitrary code with host system privileges.

Which of the following represents the BEST remediation strategy to address this host vulnerability?

  1. Enable authentication and TLS transport security on the JMX agent configuration while restricting listener access.Answer
  2. B
    Rely on the internal edge firewall to block external access while keeping the host service unauthenticated for local subnet traffic.
  3. C
    Deploy an inline web application firewall (WAF) to inspect HTTP traffic targeting port 1099.
  4. D
    Implement a detective intrusion detection system (IDS) signature to log unauthorized connection attempts.

Answer

The best remediation strategy is to enable authentication and TLS transport security directly on the JMX agent configuration and restrict network listener access.
Enabling native authentication and TLS encryption on the JMX agent addresses the vulnerability at its source by requiring valid credentials before any remote management commands or MBean registrations can take place.

Step-by-Step Solution

1
Analyze the vulnerability scan report.
Identified an unauthenticated Java JMX RMI service listening on port 1099/TCP that allows anonymous arbitrary code execution.
Understanding the specific host service vulnerability indicates whether application, protocol, or host configuration changes are needed.
2
Evaluate potential mitigations based on host hardening principles.
Disabling anonymous access and requiring authenticated, encrypted sessions prevents unauthorized invocation of management MBeans.
Host security vulnerabilities caused by insecure default service configurations must be hardened at the service level.
3
Assess alternative control choices for efficacy.
Perimeter firewalls, WAFs, and IDS controls either fail to block internal lateral movement, cannot parse RMI protocols, or merely detect rather than prevent exploitation.
Defense-in-depth requires root-cause host hardening rather than relying solely on secondary or misaligned network controls.

Key Concept

Host Service Hardening and Misconfiguration Remediation
Estimated Time:1m 30s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities