Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

An incident response team discovers that an attacker uploaded a malicious script disguised as an image file to a public web application's uploads directory. The web server process subsequently executed the script, providing the attacker with an interactive remote command shell. Investigation reveals that the file upload folder resides on a standard file system volume where the web daemon user account has both write and execute permissions. Which of the following host hardening practices is the MOST effective mitigation strategy to prevent web shell execution from this directory?

  1. A
    Deploy an inline network intrusion prevention system to inspect inbound HTTP POST requests for script execution syntax.
  2. Mount the upload directory on a dedicated partition configured with noexec flags and restrict script engine execution rights for the web daemon.Answer
  3. C
    Deploy production honeypots within the web server subnet to capture and neutralize malicious file upload payloads before they reach storage.
  4. D
    Configure perimeter firewalls to restrict inbound HTTP access to trusted client IP address ranges for the application upload endpoint.

Answer

Mounting the upload storage directory with no-execute flags and restricting web service account permissions is the most effective host hardening control.
The correct response highlights the practice of mounting user-writable directories (such as upload folders) with no-execute flags and restricting web service daemon execution rights. This directly mitigates web shell threats by ensuring that even if a file is uploaded, the operating system kernel and web application server will refuse to execute it as code.

Step-by-Step Solution

1
Analyze the attack vector and root cause.
The attacker leveraged arbitrary file upload functionality combined with execution permissions in the web server's upload folder to execute a web shell.
Identifying that the vulnerability stems from host file system permissions points directly to host hardening controls.
2
Evaluate technical host hardening mitigations.
Disabling execution permissions on the upload partition (e.g., using noexec mount options or disabling CGI/script execution in web server configuration) prevents the OS/runtime from running scripts uploaded by users.
User content directories should strictly store static media and never allow script execution.
3
Compare against network and deception controls.
Perimeter network filtering and honeypots do not fix improper file system permissions on the host.
Host-level security controls must enforce principle of least privilege and execution boundary limits directly at the resource layer.

Key Concept

Host Hardening and Directory Execution Restriction
Estimated Time:1m 30s
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic