Examkin

Question

Difficulty: Very hardMitigation Strategies and Enterprise Hardening Practices

A security analyst investigates an incident where an attacker compromised a containerized microservice pod and used stolen service account credentials to move laterally and extract confidential data from an internal backend database. The current environment relies primarily on an ingress Web Application Firewall (WAF) and perimeter firewalls, which permitted all internal pod-to-pod traffic once the perimeter was traversed. Which of the following technical mitigation strategies should the organization implement to enforce least privilege access and restrict lateral movement within the container environment?

  1. Implement a service mesh architecture with mutual TLS (mTLS) and explicit identity-based service authorization policies.Answer
  2. B
    Reconfigure the edge WAF and ingress gateway to enforce TLS 1.3 encryption and IP-based rate limiting for external incoming requests.
  3. C
    Deploy an inline deceptive honeypot pod to actively filter and block unauthorized API calls between internal microservices.
  4. D
    Apply signature-based network intrusion prevention system (NIPS) rules at the perimeter router to monitor internal database traffic.

Answer

Implementing a service mesh architecture with mutual TLS (mTLS) and explicit identity-based service authorization policies.
The correct strategy involves deploying a service mesh with mutual TLS (mTLS) and explicit service authorization policies. In microservice environments, service mesh controls enforce microsegmentation by authenticating service identities cryptographically via mTLS and enforcing granular policies that block unauthorized pod-to-pod communication, directly stopping lateral movement.

Step-by-Step Solution

1
Analyze the incident scenario and attack vector
Identified that once the perimeter was breached, the attacker performed lateral movement across internal container pods due to lack of internal access controls.
Perimeter controls (WAF/ingress firewalls) do not prevent east-west lateral movement inside a cluster once a single service is compromised.
2
Evaluate enterprise hardening strategies based on Zero Trust principles
Determined that microsegmentation and identity-based access controls are required to restrict inter-service communication.
Zero Trust mandates explicit verification for every request, regardless of whether it originates inside or outside the network boundary.
3
Select the appropriate technical control for containerized microservices
Selected service mesh with mTLS and identity-based authorization rules as the optimal technical mitigation.
Service mesh provides cryptographic identity (via mTLS certificates) to microservices and enforces fine-grained authorization policies to prevent unauthorized lateral traffic.

Key Concept

Enterprise Microsegmentation and Zero Trust Hardening
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic