Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

A security team is updating enterprise host hardening standards to prevent unauthorized software execution and mitigate memory corruption exploits on administrative workstations. Which TWO host hardening controls should the security team implement to achieve these objectives?

  1. Enforce application control policies to restrict binary execution to approved paths and verified cryptographic signaturesAnswer
  2. Enable hardware-enforced Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)Answer
  3. C
    Deploy a perimeter stateful firewall to automatically block incoming malicious HTTP and HTTPS traffic flows
  4. D
    Configure an inline production honeypot server to actively drop malicious endpoint binary execution payloads

Answer

The security team should enforce application control policies and enable Data Execution Prevention (DEP) along with Address Space Layout Randomization (ASLR).
Application control policies enforce allowlists that prevent unapproved or malicious software binaries from running on the host. Simultaneously, operating system memory protections such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) prevent malicious code execution in protected memory areas and obscure memory target addresses, mitigating memory corruption exploits.

Step-by-Step Solution

1
Identify the primary threat vectors presented in the scenario
The target threats are unauthorized binary execution and memory corruption exploits on host endpoints.
Hardening measures must directly align with the specific attack vectors identified.
2
Select the host mitigation technique for unauthorized software execution
Application control (allowlisting) ensures that only cryptographically signed or explicitly approved applications can launch.
This directly prevents untrusted scripts or malicious binaries from running.
3
Select the host mitigation technique for memory corruption vulnerabilities
Enabling DEP and ASLR prevents malicious shellcode execution in non-executable memory segments and complicates exploit payloads by obfuscating memory addresses.
These memory protection features harden operating system execution memory against buffer overflow attacks.

Key Concept

Host Hardening and Exploit Mitigations
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic