Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

A security analyst is hardening an enterprise domain environment after an internal audit revealed two critical weaknesses: unauthenticated network hosts can execute anonymous directory queries to enumerate domain user accounts, and internal authentication traffic is susceptible to credential relay attacks. Which of the following mitigation strategies should the analyst implement to address these specific vulnerabilities? (Select TWO.)

  1. Enforce LDAP server signing and channel binding requirements across domain controllers.Answer
  2. Disable NTLM authentication protocols in favor of Kerberos with enforced SMB signing.Answer
  3. C
    Deploy inline deception honeypots on the directory subnet to automatically filter unauthenticated queries.
  4. D
    Configure perimeter stateful firewall rules to block TCP port 389 traffic at the external boundary gateway.

Answer

The correct mitigations are enforcing LDAP server signing and channel binding to prevent anonymous account enumeration, and disabling legacy NTLM protocols in favor of Kerberos with SMB signing to prevent credential relay attacks.
Enforcing LDAP server signing and channel binding ensures directory queries require authentication and integrity checks, directly preventing anonymous account enumeration. Disabling legacy NTLM in favor of Kerberos with SMB signing secures authentication traffic against replay and relay attacks across internal subnets.

Step-by-Step Solution

1
Analyze the reported vulnerability regarding anonymous user enumeration.
Identified unencrypted, unsigned LDAP queries (TCP/UDP 389) permitting anonymous binding.
Requiring LDAP signing and channel binding forces client authentication and encryption, neutralizing anonymous directory enumeration.
2
Analyze the reported vulnerability regarding credential relay attacks.
Identified legacy challenge-response authentication (NTLM) being intercepted and relayed.
Migrating to Kerberos authentication and enforcing SMB signing ensures session integrity and prevents authentication relay tactics.
3
Evaluate and rule out inappropriate control selections.
Deception devices and perimeter firewalls do not solve internal directory and authentication protocol hardening requirements.
Honeypots are not inline filtering controls, and perimeter firewalls cannot prevent internal lateral relay attacks.

Key Concept

Directory Service Hardening and Secure Authentication Protocol Enforcement
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic