Examkin

Soru

Zorluk: OrtaMitigation Strategies and Enterprise Hardening Practices

A security analyst is investigating internal credential harvesting alerts resulting from unauthorized network traffic interception. The investigation reveals that attackers on the local subnet are capturing user authentication hashes by spoofing responses to unresolvable broadcast requests for local network resources. Which of the following enterprise hardening practices should the security team implement to BEST mitigate this vulnerability?

  1. Disable Link-Local Multicast Name Resolution (LLMNR) and NetBIOS over TCP/IP (NBT-NS) across endpoints via Group Policy.Cevap
  2. B
    Deploy an inline Network Intrusion Prevention System (NIPS) at the enterprise perimeter boundary.
  3. C
    Deploy production honeypots on the local subnet to block incoming broadcast traffic.
  4. D
    Reclassify local broadcast monitoring from a detective control to a preventive managerial control.

Cevap

Disable Link-Local Multicast Name Resolution (LLMNR) and NetBIOS over TCP/IP (NBT-NS) across endpoints via Group Policy.
Disabling legacy name resolution protocols such as Link-Local Multicast Name Resolution (LLMNR) and NetBIOS over TCP/IP (NBT-NS) directly removes the endpoint's vulnerability to local name poisoning attacks. When endpoints fail to resolve hostnames via standard DNS, they fall back to broadcasting queries on the local subnet. Local attackers running tools like Responder can spoof responses to these queries and trick endpoints into authenticating against attacker-controlled systems, exposing user hashes. Disabling these protocols via central policy enforces endpoint hardening and eliminates the root vector.

Adım Adım Çözüm

1
Analyze the attack vector described in the scenario
Identified that attackers are exploiting fallback local name resolution broadcast protocols (LLMNR/NBT-NS) to perform rogue response poisoning and hash harvesting.
When standard DNS resolution fails, client endpoints fall back to broadcasting queries over LLMNR and NBT-NS, allowing local attackers to spoof responses.
2
Evaluate effective host hardening mitigations
Determined that disabling LLMNR and NBT-NS centrally removes the fallback broadcast behavior entirely.
Host-level protocol disabling eliminates the attack surface without relying on network perimeter devices or reactive detection.

Anahtar Kavram

Disabling Legacy Fallback Protocols for Endpoint Hardening
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru