Match each host, network, or infrastructure vulnerability scenario on the left with its corresponding primary remediation strategy on the right.
- An internal vulnerability scan detects TCP port 445 active on host endpoints with SMBv1 enabled.Deprecate legacy protocols and enforce SMBv3 with packet signing.
- An audit reveals an enterprise cloud storage bucket containing plain-text API keys accessible via public URLs.Apply IAM bucket policy restrictions and integrate an enterprise secrets manager.
- Network telemetry shows an internal DNS server responding to unrestricted recursive queries from external IP addresses.Restrict DNS recursion to authorized internal clients and enable Response Rate Limiting (RRL).
- An embedded building automation controller transmits sensor data across the LAN using unencrypted HTTP and factory default credentials.Perform system hardening by updating default credentials and mandating TLS transport encryption.
Answer
The correct pairings match each security vulnerability scenario to its targeted technical control: SMBv1 exposure pairs with legacy protocol deprecation and SMBv3 enforcement; public cloud storage credential exposure pairs with IAM bucket restrictions and secrets management; open recursive DNS resolving pairs with recursive client restrictions and Response Rate Limiting; unencrypted embedded controller traffic with default credentials pairs with firmware hardening, credential replacement, and TLS transport encryption.
Each vulnerability scenario represents a failure at a distinct layer of the architecture (host OS protocol, cloud infrastructure access control, network core services, or embedded endpoint security). remediations must directly address the specific root cause flaw at that layer rather than relying on generic perimeter controls.
Step-by-Step Solution
Key Concept
Host, Network, and Architecture Vulnerability Remediation