Examkin

Soru

Zorluk: ZorMitigation Strategies and Enterprise Hardening Practices

During a security architecture audit of a hybrid enterprise environment, analysts discover that system administrators regularly use PowerShell Remoting (WinRM) over TLS to manage internal domain controllers directly from unmanaged endpoints connected via a split-tunnel VPN. If an unmanaged endpoint is compromised, attackers could execute arbitrary administrative commands across the internal infrastructure. Which of the following enterprise hardening strategies MOST effectively mitigates this administrative exposure while preserving required remote management capabilities?

  1. Enforce Just Enough Administration (JEA) with PowerShell constrained language mode and restrict WinRM access exclusively to dedicated Privileged Access Workstations (PAWs).Cevap
  2. B
    Deploy an inline deception honeypot listener on port 5986 at the network edge to automatically intercept and drop unauthorized WinRM administrative traffic.
  3. C
    Rely on the perimeter split-tunnel VPN gateway authentication to filter incoming PowerShell traffic before it reaches the internal network domain controllers.
  4. D
    Reclassify remote WinRM management protocols from technical security controls to deterrent controls within the enterprise risk management policy.

Cevap

Enforce Just Enough Administration (JEA) with PowerShell constrained language mode and restrict WinRM access exclusively to dedicated Privileged Access Workstations (PAWs).
The correct strategy combines host-level privilege restrictions (Just Enough Administration and PowerShell constrained language mode) with strict endpoint origin boundaries (Privileged Access Workstations). JEA limits user privileges to only the specific cmdlets required for their job function, constrained language mode prevents advanced scripting/COM object exploitation, and PAWs ensure administrative credentials cannot be harvested from unmanaged or compromised personal endpoints.

Adım Adım Çözüm

1
Analyze the core threat vector presented in the audit finding.
Unmanaged endpoints accessing high-privilege management protocols (WinRM/PowerShell) across the network create risks of credential theft, arbitrary code execution, and unconstrained administrative privilege abuse.
Hardening practices must address both host capability constraints (what commands can run) and network access constraints (which endpoints can initiate sessions).
2
Evaluate technical mitigation controls for host and session hardening.
Just Enough Administration (JEA) enforces role-based privilege limits, constrained language mode blocks arbitrary API/script invocation, and Privileged Access Workstations (PAWs) eliminate exposure from unmanaged devices.
Combining principle of least privilege at the application layer with dedicated management hardware provides comprehensive defense-in-depth enterprise hardening.
3
Eliminate inappropriate control choices based on architectural misclassifications.
Perimeter VPN reliance leaves internal systems vulnerable once inside, honeypots do not act as inline blocking controls, and policy reclassification provides zero technical risk reduction.
Effective mitigation requires active technical controls tailored to the specific exposure.

Anahtar Kavram

Privileged Access Hardening and Administrative Attack Surface Reduction
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru