Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

Match each enterprise security vulnerability finding on the left with the most effective technical hardening mitigation on the right.

  • An unsegmented internal network allows lateral movement between administrative endpoints using legacy remote access protocols.Enforce network microsegmentation and Zero Trust network access (ZTNA) isolation policies.
  • Web application servers permit execution of untrusted user-uploaded payloads stored in temporary filesystem locations.Mount temporary storage partitions with `noexec` and `nosuid` filesystem parameters.
  • High-privilege domain administrator credentials are exposed to LSASS memory harvesting attacks on compromised remote target endpoints.Implement Remote Credential Guard and Restricted Admin mode for privileged sessions.

Answer

1. Unsegmented network lateral movement matches with enforcing network microsegmentation and ZTNA policies. 2. Untrusted payload execution in temporary directories matches with mounting temporary storage partitions with `noexec` and `nosuid` parameters. 3. Credential exposure in LSASS memory matches with implementing Remote Credential Guard and Restricted Admin mode.
The security findings correctly map to their specific technical mitigations: internal lateral movement requires microsegmentation and ZTNA; temporary storage execution threats require `noexec` mount options; and remote LSASS memory credential dumping requires Remote Credential Guard.

Step-by-Step Solution

1
Evaluate network isolation requirements for internal traffic.
Network microsegmentation and Zero Trust access policies restrict unauthorized host-to-host communications across internal subnets.
Perimeter defenses do not prevent lateral movement once an attacker gains initial access inside an enterprise network.
2
Determine host storage hardening techniques for temporary filesystems.
Mounting directories such as `/tmp` with `noexec` prevents the execution of binaries and scripts stored in scratch space.
Hardening storage mount points reduces the attack surface by enforcing strict execution boundaries on untrusted directories.
3
Select memory protection controls for privileged remote administration.
Remote Credential Guard and Restricted Admin mode prevent domain credentials from being stored in LSASS memory on remote hosts.
Processing authentication client-side ensures high-privilege credentials cannot be dumped by LSASS scraping malware on the destination system.

Key Concept

Enterprise Hardening and Technical Security Controls
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic