Examkin

Soru

Zorluk: OrtaHost, Network, and Architecture Vulnerabilities

A security technician running an infrastructure discovery scan receives the following report for an internal management host:

[+] Host 192.168.10.45:161/UDP - Active
[+] Protocol: SNMPv2c
[+] Community String: public
[+] Extracted Info: SysName: HV-NODE01, OS: Linux 4.19, Interfaces: eth0 (192.168.10.45), eth1 (10.50.0.1 - Storage SAN)

Which of the following represents the primary host and network architecture vulnerability demonstrated in this scan output?

  1. Exposure of sensitive host system information and internal network topology through cleartext protocols with default credentialsCevap
  2. B
    Failure of an inline web application firewall to inspect and sanitize SQL injection payloads targeting database backends
  3. C
    Deploying perimeter network firewall rules to mitigate application-layer memory buffer overflow vulnerabilities on the host
  4. D
    Misclassifying active SNMP monitoring daemons as detective security controls rather than preventive boundary controls

Cevap

The primary vulnerability is the exposure of sensitive host system information and internal network topology through cleartext protocols utilizing default community strings.
The correct answer highlights that SNMPv2c sends data in cleartext and using the default community string ('public') exposes sensitive system details—such as OS version, internal IP addresses, and SAN network topology—to unauthorized network reconnaissance.

Adım Adım Çözüm

1
Analyze the scanner log output
Identified active UDP port 161 running SNMPv2c with community string 'public'.
SNMPv2c lacks native cryptographic encryption and relies on cleartext community strings for access control.
2
Evaluate the exposed data surface
The scan retrieved system hostname, OS version, and network interface addresses (including internal SAN access).
Default community strings like 'public' combined with cleartext management protocols allow unauthorized reconnaissance of host hardware and internal infrastructure topology.
3
Determine the primary architectural vulnerability
Conclude that insecure protocol selection (SNMPv2c vs. encrypted SNMPv3) and failure to change default management credentials create significant information exposure.
Hardening host and network infrastructure requires replacing unencrypted legacy management protocols and disabling default community strings.

Anahtar Kavram

Host and Infrastructure Management Protocol Hardening (SNMP Security)
Bu soruyu puanla

Konular

Host, Network, and Architecture Vulnerabilities