Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

An enterprise security team is defining enterprise hardening requirements for a fleet of Linux-based edge compute gateways deployed at remote industrial facilities. A recent security audit highlighted two critical vulnerabilities: field technicians currently perform local configuration updates using a shared administrative account, and automated firmware updates are downloaded over unencrypted channels without integrity verification. Which TWO of the following mitigation controls should the team implement to directly address these findings?

  1. Enforce SSH public key authentication linked to unique identity provider accounts and disable interactive password logins for administrative accounts.Answer
  2. Configure hardware-backed Trusted Platform Module (TPM) chips to cryptographically verify firmware digital signatures prior to installation.Answer
  3. C
    Deploy inline network intrusion prevention systems (NIPS) on local management VLANs to automatically scrub malicious payloads from firmware binaries during transit.
  4. D
    Configure edge perimeter firewalls to automatically trust and grant administrative access to all incoming traffic originating from the internal corporate network segment.

Answer

The team should enforce SSH public key authentication linked to unique identity provider accounts while disabling interactive password logins, and configure hardware-backed Trusted Platform Module (TPM) chips to cryptographically verify firmware digital signatures prior to installation.
The correct controls directly resolve both audit findings. Enforcing individual SSH public keys tied to unique identity accounts eliminates shared credential usage and establishes full accountability. Hardware-backed TPM verification checks the digital signature of firmware binaries before execution, ensuring code authenticity regardless of the transit path.

Step-by-Step Solution

1
Analyze the credential management vulnerability identified in the audit finding.
Shared administrative accounts prevent individual accountability and increase credential exposure risk.
Replacing shared local account passwords with centralized, individual SSH public key authentication enforces least privilege and non-repudiation.
2
Analyze the firmware deployment vulnerability identified in the audit finding.
Unencrypted downloads without validation allow potential tampering or man-in-the-middle software injection.
Cryptographic signature validation anchored in a hardware Trusted Platform Module (TPM) verifies that firmware originates from a trusted vendor and remains unaltered before installation.
3
Evaluate and discard ineffective distractor controls.
Inline NIPS cannot modify or validate binary signatures, and perimeter trust models fail to enforce Zero Trust security.
Technical controls must directly address the specific root vulnerabilities identified in the audit.

Key Concept

Mitigation Strategies and Enterprise Hardening Practices
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic