Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

Match each host, network, or infrastructure vulnerability scenario on the left with its corresponding primary remediation strategy on the right.

  • An internal vulnerability scan detects TCP port 445 active on host endpoints with SMBv1 enabled.Deprecate legacy protocols and enforce SMBv3 with packet signing.
  • An audit reveals an enterprise cloud storage bucket containing plain-text API keys accessible via public URLs.Apply IAM bucket policy restrictions and integrate an enterprise secrets manager.
  • Network telemetry shows an internal DNS server responding to unrestricted recursive queries from external IP addresses.Restrict DNS recursion to authorized internal clients and enable Response Rate Limiting (RRL).
  • An embedded building automation controller transmits sensor data across the LAN using unencrypted HTTP and factory default credentials.Perform system hardening by updating default credentials and mandating TLS transport encryption.

Answer

The correct pairings match each security vulnerability scenario to its targeted technical control: SMBv1 exposure pairs with legacy protocol deprecation and SMBv3 enforcement; public cloud storage credential exposure pairs with IAM bucket restrictions and secrets management; open recursive DNS resolving pairs with recursive client restrictions and Response Rate Limiting; unencrypted embedded controller traffic with default credentials pairs with firmware hardening, credential replacement, and TLS transport encryption.
Each vulnerability scenario represents a failure at a distinct layer of the architecture (host OS protocol, cloud infrastructure access control, network core services, or embedded endpoint security). remediations must directly address the specific root cause flaw at that layer rather than relying on generic perimeter controls.

Step-by-Step Solution

1
Analyze host protocol vulnerability (left item 1)
Identified SMBv1 legacy protocol risk
SMBv1 lacks modern security features and is susceptible to exploitation, requiring protocol deprecation and migration to SMBv3.
2
Analyze cloud infrastructure vulnerability (left item 2)
Identified public bucket and cleartext secret exposure
Cloud storage configuration issues are resolved by enforcing strict IAM access controls and externalizing secret management.
3
Analyze network infrastructure vulnerability (left item 3)
Identified open DNS recursive resolver exposure
Open DNS resolvers facilitate amplification attacks, requiring ACLs to limit recursive queries to trusted internal clients.
4
Analyze embedded architecture vulnerability (left item 4)
Identified weak authentication and unencrypted operational technology traffic
Embedded systems must be hardened by changing default credentials and enforcing encrypted transport protocols.

Key Concept

Host, Network, and Architecture Vulnerability Remediation
Rate this question