Examkin

Question

Difficulty: Very hardMitigation Strategies and Enterprise Hardening Practices

An enterprise security architect is mapping enterprise hardening controls to specific vulnerability findings identified during a comprehensive threat assessment. Match each enterprise mitigation strategy on the left with the threat or attack vector on the right that it is primarily designed to counter.

  • DNS Sinkholing coupled with DNSSEC validationRogue outbound command-and-control (C2) traffic utilizing DNS tunneling or domain generation algorithms (DGAs)
  • Microsegmentation utilizing host-based firewalls and network access control policiesLateral movement and unauthorized east-west traffic propagation following a single workload compromise
  • Application allowlisting via strict code-signing and publisher policy enforcementExecution of unapproved zero-day binary payloads and unauthorized dynamic-link libraries (DLLs)
  • Privileged Access Management (PAM) with Just-In-Time (JIT) access and dual-operator controlsInsider threat abuse of persistent standing administrative privileges to bypass change management and exfiltrate data

Answer

Each enterprise mitigation strategy accurately maps to its corresponding risk: DNS sinkholing counters command-and-control (C2) channel establishing via DNS hijacking/tunneling; microsegmentation mitigates internal lateral movement across compromised workloads; application allowlisting blocks unauthorized zero-day software execution; and Privileged Access Management with JIT access eliminates standing rights to prevent insider privilege abuse.
The correct pairings align each defense-in-depth control with the primary attack vector it neutralizes: DNS sinkholing and DNSSEC address malicious domain resolution and C2 tunneling; host-level microsegmentation controls east-west traffic to halt lateral movement; application allowlisting enforces code-signing requirements to prevent unauthorized code execution; and PAM with JIT access revokes standing administrative rights to prevent insider abuse and unauthorized privilege exploitation.

Step-by-Step Solution

1
Analyze the technical mechanism of DNS sinkholing with DNSSEC validation.
Identified that inspecting and redirecting DNS queries directly targets malicious domain lookup behavior typical of malware calling home via domain generation algorithms (DGAs) or DNS tunneling.
DNS-level mitigations specifically operate on domain resolution traffic to neutralize outbound C2 channels.
2
Evaluate the architectural purpose of host-based microsegmentation.
Determined that enforcing strict policy boundaries between host workloads prevents network traversal between internal nodes.
Microsegmentation is explicitly designed to contain blast radiuses by preventing unauthorized lateral (east-west) traffic flow.
3
Assess the operational mechanism of application allowlisting via code-signing enforcement.
Recognized that blocking execution based on digital signature certificates prevents unauthorized scripts, DLLs, and binary executables from running.
Allowlisting explicitly blocks untrusted binaries and zero-day executables that lack pre-approved publisher attestations.
4
Review Privileged Access Management (PAM) with Just-In-Time (JIT) and dual-operator controls.
Matched temporary privilege elevation and secondary approval workflows to the mitigation of standing administrative access abuse.
Removing persistent standing privileges and enforcing peer verification addresses insider threats and unauthorized administrative modifications.

Key Concept

Mitigation Strategies and Enterprise Hardening Practices
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic