Examkin

Question

Difficulty: HardMitigation Strategies and Enterprise Hardening Practices

A security engineer is hardening an internal enterprise environment following an incident where an adversary established initial access on an administrative endpoint, extracted LSASS memory credentials, and executed lateral movement using unencrypted Server Message Block (SMB) sessions across internal network segments. Which TWO of the following enterprise host hardening strategies would most effectively mitigate these lateral movement techniques?

  1. Enforce SMB signing and encryption via baseline policies while disabling legacy SMB dialects across all host endpoints.Answer
  2. Enable hypervisor-protected code integrity (HVCI) and Windows Defender Credential Guard on all administrative workstations.Answer
  3. C
    Deploy an inline deception honeypot sensor on internal VLAN switches to drop unauthorized SMB session requests.
  4. D
    Reconfigure perimeter firewalls to block port 445 on external-facing internet interfaces.

Answer

The two effective mitigation strategies are enforcing SMB signing and encryption while disabling legacy protocols, and enabling virtualization-based security controls such as Credential Guard and HVCI on administrative endpoints.
To mitigate memory-based credential harvesting and internal SMB session exploitation, organizations must harden individual hosts. Virtualization-based security mechanisms like Credential Guard protect sensitive LSASS memory from extraction tools, while mandatory SMB signing and session encryption ensure that internal network communications are verified and protected from tampering or interception.

Step-by-Step Solution

1
Analyze the attack vectors identified in the incident description.
The adversary leveraged LSASS memory extraction to steal credentials and moved laterally using unencrypted SMB communications.
Targeted mitigations must directly neutralize credential dumping and internal SMB session manipulation.
2
Evaluate technical controls for securing credential storage in memory.
Enabling Credential Guard isolates the LSASS process inside a virtualized container, rendering memory-dumping tools ineffective.
Virtualization-based security isolates secrets from the underlying operating system kernel.
3
Evaluate technical controls for securing host-to-host network protocols.
Mandating SMB signing and protocol encryption ensures confidentiality and message integrity, preventing pass-the-hash or relay attacks over SMB.
Cryptographic signing and session encryption mitigate man-in-the-middle and replay attacks across internal hosts.

Key Concept

Enterprise Host Hardening and Zero Trust Host Mitigations
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic