Examkin

Question

Difficulty: HardMitigation Strategies and Enterprise Hardening Practices

An enterprise infrastructure security team is implementing system hardening practices to remediate recent penetration test findings. Match each specific technical hardening control to the primary vulnerability mechanism or attack vector it directly suppresses.

  • Implementation of Privileged Access Management (PAM) with ephemeral Just-In-Time (JIT) credentialsPersistent abuse of static administrative accounts and unmonitored high-privilege credentials
  • Enforcement of Windows Defender Application Control (WDAC) using strict publisher rulesExecution of untrusted binary payloads, rogue scripts, and unauthorized DLL injections
  • Mandating SMB Signing and disabling legacy LLMNR/NBT-NS protocolsAdversary-in-the-middle NTLM relay attacks utilizing multicast/broadcast name resolution spoofing
  • Enabling kernel-level Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)In-memory buffer overflow exploitation attempting to execute arbitrary code in stack or heap space

Answer

1. Privileged Access Management with JIT credentials matches persistent abuse of static administrative accounts.
2. Windows Defender Application Control matches execution of untrusted binary payloads and scripts.
3. Mandating SMB Signing and disabling legacy protocols matches adversary-in-the-middle NTLM relay attacks.
4. Enabling ASLR and DEP matches in-memory buffer overflow exploitation.
Each hardening strategy directly targets the underlying architectural vulnerability: PAM with JIT controls privileged account lifecycle; application allowlisting (WDAC) enforces software execution integrity; SMB signing and disabling LLMNR eliminate local MitM relay vectors; and ASLR/DEP defend memory space against execution of buffer overflow exploits.

Step-by-Step Solution

1
Analyze the scope of Privileged Access Management (PAM) with ephemeral credentials.
Identify that JIT credentials directly eliminate standing administrative privileges and static credentials.
Temporary access limits exposure windows for compromised credentials.
2
Evaluate application allowlisting mechanisms such as WDAC.
Determine that strict publisher rules block unauthorized binary execution and rogue DLLs.
Only signed binaries from trusted software vendors are permitted to launch.
3
Assess protocol-level hardening including SMB signing and disabling LLMNR/NBT-NS.
Connect these network configuration changes to mitigating local name resolution spoofing and NTLM relaying.
Disabling unauthenticated broadcast protocols eliminates the MitM vector, and SMB signing ensures packet integrity.
4
Examine memory protection controls like ASLR and DEP.
Link memory location randomization and non-executable memory flags to neutralizing buffer overflow exploits.
DEP stops payload execution in data pages, and ASLR makes memory addresses unpredictable for exploit payloads.

Key Concept

Enterprise System Hardening and Attack Surface Reduction Controls
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic