Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

During a routine security assessment of hypervisor hosts in an enterprise data center, a security analyst reviews the following vulnerability scan report snippet:

Host: 192.168.42.15
Port: 427/TCP, 427/UDP
Service: Service Location Protocol (SLP)
Vulnerability: Remote Code Execution via Pre-Authentication Heap Overflow
CVSS Score: 9.8 (Critical)
Summary: Unauthenticated remote users can execute arbitrary code with root privileges on the hypervisor host by sending crafted SLP requests.

Which of the following network architecture and host hardening controls represents the MOST effective immediate remediation to eliminate this exposure without disrupting guest virtual machine operations?

  1. Disable the SLP service on the hypervisor host and isolate the management interface within a dedicated out-of-band management VLAN.Answer
  2. B
    Configure stateful edge firewall rules to block inbound external traffic targeting TCP and UDP port 427.
  3. C
    Deploy an inline web application firewall (WAF) to inspect HTTP header requests directed at the host management IP.
  4. D
    Enable parameterized database queries and input sanitization on all guest web applications hosted on the hypervisor.

Answer

Disable the SLP service on the hypervisor host and isolate the management interface within a dedicated out-of-band management VLAN.
Disabling the vulnerable SLP service directly eliminates the pre-authentication root exploit vector on the host. Restricting management access to an out-of-band management VLAN enforces network segmentation so that hypervisor administration is isolated from general network segments and guest VM traffic.

Step-by-Step Solution

1
Analyze the vulnerability report to identify the target service and layer.
The target is port 427 (Service Location Protocol - SLP) running natively on the hypervisor management operating system, permitting pre-authentication root-level execution.
Identifying the affected component determines whether host-level or application-level mitigations are required.
2
Evaluate remediation options for host service exposure.
Disabling the vulnerable host daemon (SLP) removes the attack surface directly, and restricting access via a dedicated out-of-band VLAN prevents unauthorized internal reachability.
Disabling unnecessary host services and implementing microsegmentation/VLAN isolation are core host hardening and network architecture best practices.

Key Concept

Host Service Hardening and Out-of-Band Management Architecture
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities