Examkin

Soru

Zorluk: OrtaMitigation Strategies and Enterprise Hardening Practices

During a post-incident review, a security analyst discovers that an attacker who gained initial access through a compromised web application loaded a custom Loadable Kernel Module (LKM) to establish a rootkit and achieve kernel-level persistence on a production Linux server. Which host hardening practice provides the MOST effective mitigation to prevent unauthorized kernel module execution?

  1. Restricting module insertion after boot by locking kernel module loading via sysctl runtime parametersCevap
  2. B
    Deploying an inline network intrusion prevention system (NIPS) to monitor encrypted HTTPS application traffic
  3. C
    Configuring perimeter firewall rules to block incoming SSH management access on TCP port 22
  4. D
    Installing a high-interaction network honeypot to capture and inline-block malicious rootkit installation commands

Cevap

Restricting module insertion after boot by locking kernel module loading via sysctl runtime parameters is the most effective host hardening mitigation.
The correct option correctly identifies kernel parameter hardening as the direct technical mitigation for Loadable Kernel Module (LKM) rootkits. Disabling dynamic module loading via system configuration prevents any user space process—even those operating with root privileges—from inserting unverified code into kernel memory space after the system finishes booting.

Adım Adım Çözüm

1
Analyze the threat vector described in the scenario.
The attacker achieved local privilege escalation and persistence by dynamically inserting a Loadable Kernel Module (LKM) into kernel memory after compromising an application.
Understanding the attack surface (local host kernel subsystem) is required to select an appropriate host-level control.
2
Evaluate potential host-hardening controls specifically targeted at kernel space protection.
Disabling runtime module loading (e.g., setting kernel.modules_disabled = 1 after boot) permanently restricts kernel module modifications for the operational lifetime of the host.
Host-hardening strategies must enforce the principle of least privilege at the operating system kernel layer.
3
Differentiate effective host controls from network-based or perimeter controls.
Network firewalls, IPS devices, and deception honeypots operate outside the local kernel and cannot block local in-memory LKM execution.
Host vulnerabilities require host-centric hardening measures rather than perimeter or detective controls.

Anahtar Kavram

Host Hardening and OS Kernel Security Controls
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru