Examkin

Soru

Zorluk: OrtaHost, Network, and Architecture Vulnerabilities

A security analyst inspects a vulnerability scan report for an internal legacy application host. The report displays the following output:

Host: 10.12.8.44
Service: SMBv1 (Port 445/TCP)
Finding: Legacy file-sharing protocol active; vulnerable to remote code execution (MS17-010) and anonymous NULL session enumeration.
Risk Level: Critical

Which of the following actions represents the MOST effective host mitigation strategy to address this specific vulnerability?

  1. Disable the legacy SMBv1 feature on the host operating system and require SMB signing for connection sessions.Cevap
  2. B
    Rely on the network perimeter firewall to block inbound TCP port 445 traffic while leaving SMBv1 enabled for internal segment hosts.
  3. C
    Configure an inline Web Application Firewall (WAF) rule to sanitize SQL injection syntax in port 445 network traffic payloads.
  4. D
    Reclassify the target host server network adapter as a detective security control to restrict unauthenticated access.

Cevap

Disabling the legacy SMBv1 feature on the host operating system and requiring SMB signing for connection sessions.
The most effective remediation is disabling the insecure, deprecated SMBv1 protocol directly on the host operating system and enforcing SMB signing. This removes the attack surface associated with legacy file-sharing vulnerabilities (such as MS17-010/EternalBlue) and prevents unauthorized NULL session enumeration.

Adım Adım Çözüm

1
Analyze the vulnerability report finding
Identified SMBv1 on TCP port 445 as a host protocol vulnerability susceptible to remote execution and NULL session enumeration.
Understanding the precise root cause host vulnerability dictates the appropriate remediation measure.
2
Evaluate mitigation controls for host vulnerabilities
Directly disabling outdated SMBv1 services and requiring secure SMB signing eliminates the flaw at the endpoint host.
Host hardening requiring removal of legacy protocols provides defense-in-depth and prevents lateral movement within internal network segments.

Anahtar Kavram

Host and Infrastructure Hardening - Disabling Legacy Protocols
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Host, Network, and Architecture Vulnerabilities