Examkin

Soru

Zorluk: ZorMitigation Strategies and Enterprise Hardening Practices

During a post-incident analysis of a compromised legacy industrial control jump server, security auditors discover that attackers leveraged an unquoted service path vulnerability combined with permissive folder write permissions to execute arbitrary code with SYSTEM privileges. The jump server cannot be immediately decommissioned or upgraded due to operational uptime dependencies. Which of the following mitigation strategies provides the MOST effective immediate technical control to prevent execution of unauthorized binaries in these writable paths while preserving host stability?

  1. Implement application allowlisting policies enforcing path and hash-based rules via AppLocker or WDAC.Cevap
  2. B
    Reconfigure perimeter firewall rules to block outbound TCP port 445 and UDP port 139 traffic from the jump server.
  3. C
    Deploy an inline honeypot listener on the local subnet to detect unauthorized privilege escalation sweeps.
  4. D
    Classify the jump server host within a demilitarized zone (DMZ) control category and rely on network intrusion prevention system (NIPS) signatures.

Cevap

Implementing application allowlisting policies enforcing path and hash-based rules via AppLocker or Windows Defender Application Control (WDAC).
Application allowlisting controls, such as Microsoft AppLocker or Windows Defender Application Control (WDAC), prevent untrusted binaries from executing regardless of file location or service privilege levels. By defining strict hash or path rules, any unauthorized binary dropped into an unquoted service directory will be blocked from launching, directly mitigating the privilege escalation threat on legacy systems without requiring disruptive software updates.

Adım Adım Çözüm

1
Analyze the vulnerability vectors
Identified local file-system level privilege escalation (unquoted service path + permissive write access).
Understanding the attack mechanism is necessary to choose a control at the appropriate architectural layer.
2
Evaluate host-level versus network-level controls
Network firewalls and perimeter IPS cannot inspect or restrict local process creation or binary execution on the operating system.
Eliminates network-focused options that fail to remediate local host execution vulnerabilities.
3
Select preventative hardening technique for legacy environments
Application allowlisting (AppLocker/WDAC) restricts execution strictly to approved cryptographic hashes or trusted paths.
Allows legitimate legacy services to execute while blocking unauthorized binaries placed in writable unquoted service paths without requiring immediate service re-architecture.

Anahtar Kavram

Application Allowlisting and Host Hardening Mitigations
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru