Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

Match each enterprise security risk scenario on the left with the most effective enterprise hardening mitigation on the right.

  • Adversaries running unauthorized portable executables and unverified scripts from user temporary directories.Deploy Application Allowlisting policies enforcing publisher-signed code execution restrictions.
  • Lateral movement attacks utilizing legacy protocol downgrades and credential harvesting in Active Directory.Disable NTLMv1 and SMBv1 protocols while enforcing Kerberos and SMB Signing enterprise-wide.
  • Unauthorized bootloader modification and rootkit persistence during early system startup.Enable UEFI Secure Boot backed by a hardware-based Trusted Platform Module (TPM).
  • Physical data exfiltration and rogue firmware injection via unmonitored client peripheral connections.Implement centralized UASP and USB Mass Storage class disabling via endpoint management policy.

Answer

Each enterprise security risk maps directly to its specific technical hardening control: executing unauthorized binaries is mitigated by application allowlisting; legacy protocol exploitation is mitigated by disabling NTLMv1/SMBv1; bootloader tampering is mitigated by UEFI Secure Boot and TPM; and physical peripheral threats are mitigated by disabling USB storage device classes.
Each risk finding is addressed by its corresponding host or infrastructure hardening strategy: unauthorized application execution is directly prevented by application allowlisting; credential theft via protocol downgrades is mitigated by deprecating legacy protocols like NTLMv1/SMBv1; bootloader integrity tampering is prevented by hardware-backed UEFI Secure Boot; and physical storage exfiltration is controlled by disabling USB device classes.

Step-by-Step Solution

1
Analyze execution risks from untrusted paths and match with application control mechanisms.
Identify that restricting unapproved scripts/executables requires Application Allowlisting policies.
Traditional antivirus alone often fails against custom or unverified binaries running from user directories.
2
Analyze domain lateral movement techniques relying on legacy protocols.
Identify that disabling NTLMv1/SMBv1 blocks relay and downgrade attacks.
Hardening domain network traffic requires enforcing modern protocols like Kerberos and SMB Signing.
3
Evaluate boot-level bootkit and rootkit threat vectors.
Identify that verifying pre-OS code integrity requires UEFI Secure Boot and TPM.
Hardware-rooted trust ensures that modified bootloaders cannot load before OS security controls start.
4
Evaluate physical endpoint security vectors.
Identify that restricting USB storage classes mitigates local exfiltration via peripheral devices.
Host peripheral port restriction is a key host-hardening practice for preventing physical vector compromises.

Key Concept

Enterprise Host and Infrastructure Hardening Mitigations
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic