Examkin

Question

Difficulty: HardMitigation Strategies and Enterprise Hardening Practices

An enterprise security architect is evaluating system hardening controls to address findings from a comprehensive technical vulnerability audit. Match each enterprise hardening practice on the left to its corresponding primary risk mitigation objective on the right.

  • Implementation of eBPF (Extended Berkeley Packet Filter) runtime hooksMonitors and restricts system call execution at the OS kernel level to detect rootkit behavior and prevent container breakout attempts.
  • Automated deployment of ephemeral short-lived access credentialsReduces the blast radius and exposure window resulting from leaked API keys or stolen service tokens across cloud infrastructure.
  • Configuration of DNS RPZ (Response Policy Zone) sinkholingBlocks outbound command-and-control (C2) resolution requests and prevents DNS-based data exfiltration to known malicious domains.
  • Enforcement of ASLR (Address Space Layout Randomization) paired with DEP/NX flagsNeutralizes buffer overflow and code injection exploits by randomizing process memory structures and marking data segments as non-executable.

Answer

eBPF runtime hooks match kernel-level system call monitoring and container breakout detection. Automated ephemeral credentials match reducing the exposure window of stolen service tokens. DNS RPZ sinkholing matches blocking outbound C2 domain resolution. ASLR with DEP/NX flags matches neutralizing buffer overflow and code injection exploits.
Each listed hardening control addresses a distinct technical attack vector: eBPF monitors kernel system calls to stop privilege escalation and container escapes; ephemeral access tokens limit credential abuse duration; DNS RPZ intercepts malicious outbound domain queries; and ASLR paired with DEP prevents buffer overflow code execution.

Step-by-Step Solution

1
Analyze the technical operation of eBPF instrumentation.
Determined that eBPF runs sandboxed programs directly within the Linux kernel to trace system calls and enforce container security limits.
Kernel-level visibility directly addresses host and container runtime hardening.
2
Evaluate the risk reduction mechanism of short-lived ephemeral credentials.
Identified that enforcing short validity periods limits credential reuse opportunities during token leakage incidents.
Identity hardening focuses on minimizing threat actor persistence windows.
3
Determine the functional role of DNS Response Policy Zones (RPZ).
Recognized that RPZ filters and redirects DNS lookups for known malicious domains before outbound network connections complete.
Network egress hardening prevents malware C2 callback channels.
4
Examine memory protection controls ASLR and DEP/NX.
Confirmed that memory address randomization combined with non-executable stack/heap flags thwarts exploit payloads relying on static memory offsets.
OS memory hardening prevents binary corruption exploits.

Key Concept

Enterprise mitigation techniques across kernel runtime security, identity lifecycle management, network egress filtering, and OS memory protection.
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic