Examkin

Question

Difficulty: HardHost, Network, and Architecture Vulnerabilities

An enterprise facility relies on a legacy industrial control host running an End-of-Life (EoL) operating system that cannot receive vendor software patches. A vulnerability assessment reveals that this host communicates via unauthenticated embedded management protocols and resides on the same broad broadcast domain as employee workstations. Which of the following architectural strategies is the BEST mitigation to reduce threat exposure while ensuring continued operational functionality?

  1. Place the legacy system into an isolated network segment configured with microsegmentation and strict firewall access control lists (ACLs).Answer
  2. B
    Rely on the enterprise perimeter firewall and Network Address Translation (NAT) to protect the internal host from external threats.
  3. C
    Deploy host-based Intrusion Detection System (HIDS) agents in detective mode to monitor process execution logs on the legacy system.
  4. D
    Apply web application firewall (WAF) inspect rules at the corporate egress router to block Cross-Site Scripting (XSS) attacks.

Answer

The best mitigation is to place the legacy host into an isolated network segment with microsegmentation and strict access control lists.
Placing an End-of-Life (EoL) host into an isolated network segment using microsegmentation and strict firewall access control lists (ACLs) is the most effective compensating control. Because software patches are unavailable for EoL systems, network-level isolation prevents unauthorized endpoints on the corporate network from accessing exposed management services while permitting required operational traffic.

Step-by-Step Solution

1
Analyze the constraint of End-of-Life (EoL) software.
Recognize that patch management is not viable because vendor patches do not exist.
Vulnerabilities in EoL host systems cannot be remediated directly at the operating system level.
2
Evaluate the architectural risk caused by flat network exposure.
Identify that positioning an vulnerable EoL host on the general corporate subnet exposes it to internal lateral movement.
Zero Trust principles mandate continuous verification and network containment regardless of internal positioning.
3
Select the appropriate compensating security control.
Implement network segmentation/microsegmentation and strict ACLs to isolate the host.
Isolating legacy architecture limits network access solely to authorized management endpoints, mitigating exposure without interrupting operations.

Key Concept

Host Isolation and Microsegmentation for Legacy Architecture Vulnerabilities
Estimated Time:2m 0s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities