Examkin

Question

Difficulty: HardHost, Network, and Architecture Vulnerabilities

A security analyst conducts an internal infrastructure vulnerability assessment on an enterprise network segment containing legacy servers. The assessment scan report reveals the following open ports and vulnerability indicators:

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4 (Anonymous login permitted)
23/tcp open telnet Legacy router management service
445/tcp open smb Windows Server 2008 R2 (SMBv1 enabled / CVE-2017-0144 detected)

The security operations team must immediately address the threat of unauthenticated remote code execution (RCE) exploitation traversing the internal network while long-term migration plans are finalized. Which of the following mitigations is the MOST effective immediate action to eliminate this specific vulnerability vector?

  1. Disable SMBv1 host configurations and enforce SMB signing/SMBv2+ across internal group policies.Answer
  2. B
    Deploy a Web Application Firewall (WAF) at the network border to inspect HTTP/HTTPS payloads for malicious commands.
  3. C
    Reconfigure the external perimeter firewall to block inbound SMB connections while leaving internal inter-VLAN traffic unmonitored.
  4. D
    Reclassify the vulnerability severity in the SIEM to trigger a detective alert baseline rather than applying host hardening controls.

Answer

Disable SMBv1 host configurations and enforce SMB signing/SMBv2+ across internal group policies.
Disabling SMBv1 directly removes the legacy protocol vulnerability (CVE-2017-0144) responsible for unauthenticated remote code execution. This host protocol hardening action prevents exploitation regardless of network perimeter boundaries.

Step-by-Step Solution

1
Analyze the vulnerability scan report findings
Identify port 445 running legacy SMBv1 with known remote code execution flaw CVE-2017-0144 as the critical RCE attack vector.
Targeting the specific vulnerability requested (unauthenticated RCE) requires isolating SMBv1 on port 445 rather than cleartext authentication services (Telnet/FTP).
2
Evaluate candidate mitigation controls against the host vulnerability
Disabling the deprecated SMBv1 protocol removes the vulnerable code path directly from host operating systems.
Host protocol hardening eliminates the root cause vulnerability without relying solely on perimeter filters or unrelated web application controls.

Key Concept

Host Hardening and Vulnerability Mitigation for Legacy Network Protocols
Estimated Time:2m 0s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities