Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

A security analyst reviews a vulnerability assessment report for legacy environmental monitoring sensors installed across a data center. The report reveals that the sensors transmit operational telemetry in cleartext using SNMPv1 with default community strings. The vendor confirms the embedded hardware cannot support firmware updates, protocol upgrade to SNMPv3, or host-level encryption. Which of the following architectural security controls represents the MOST effective mitigation to protect against internal eavesdropping and unauthorized control commands?

  1. Isolate the sensors on a dedicated out-of-band management VLAN and enforce access control lists through an inspecting security gateway.Answer
  2. B
    Rely on boundary perimeter firewalls to block inbound traffic on UDP port 161 originating from external public networks.
  3. C
    Install a host-based intrusion prevention system agent directly onto each physical sensor node to restrict process modification.
  4. D
    Deploy an inline web application firewall to detect and filter out SQL injection payloads directed at sensor interfaces.

Answer

Isolate the sensors on a dedicated out-of-band management VLAN and enforce access control lists through an inspecting security gateway.
When legacy hardware cannot be patched or upgraded to support secure encrypted protocols like SNMPv3, deploying compensating network controls—such as placing devices on an isolated out-of-band management VLAN with strict access controls—is the most effective method to mitigate unauthorized access and cleartext data leakage.

Step-by-Step Solution

1
Analyze the technical constraints presented in the scenario.
Identified that legacy sensor hardware cannot be patched, upgraded to SNMPv3, or host encrypted.
Host-level remediations are technically impossible due to device limitations.
2
Evaluate the risk vector associated with SNMPv1 cleartext transmission and default community strings.
Determined that internal network users or attackers who gain internal access can sniff telemetry or send unauthorized management commands.
Cleartext management traffic on shared networks is vulnerable to interception and unauthorized manipulation.
3
Select the appropriate compensating architectural control.
Network microsegmentation via an isolated out-of-band VLAN restricts traffic flow so that only authorized management systems can reach the unpatchable legacy endpoints.
Compensating network controls provide defense-in-depth when host systems cannot be remediated directly.

Key Concept

Compensating Network Controls and Microsegmentation for Legacy Architecture Vulnerabilities
Estimated Time:1m 30s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities