212-82 Question #126: Real Exam Question with Answer & Explanation

Question

You are the chief cybersecurity officer at a multi-national corporation, which specializes in satellite- based communication systems. Recently, you transitioned to a more advanced system architecture that includes multiple ground stations globally. These stations synchronize and communicate via a central hub that manages the distribution of encrypted data across the network. Upon reviewing the quarterly network logs, you uncover a series of sophisticated intrusions. These intrusions are intermittently taking place inground stations located in three continents. Evidence suggests that these attacks are coordinated, aiming to map out the network's communication paths, likely in preparation for a much larger scale cyber-attack. Further investigation uncovers small pockets of malware within the system, specifically designed to circumvent your current security controls. Given the criticality of ensuring uninterrupted satellite communication, which countermeasure would be most effective in thwarting these intrusions, ensuring data integrity, and maintaining the operational status of your satellite communication systems?

Options

• AEnhance end-point security solutions at each ground station, focusing on advanced malware
• BImplement air-gapped systems for each ground station to ensure complete isolation, minimizing
• CDeploy an advanced network segmentation strategy, ensuring each ground station operates in a
• DRollback the system to its previous architecture, while launching a thorough investigation into the

Explanation

Given coordinated intrusions mapping communication paths across a globally distributed network, implementing an advanced network segmentation strategy is crucial to contain threats and limit lateral movement.

Common mistakes.

• A. Enhancing endpoint security is important but addresses threats at the individual device level, and while necessary, it doesn't solve the problem of lateral movement and communication path mapping across a network of ground stations.
• B. Implementing air-gapped systems for globally synchronized ground stations that "communicate via a central hub" is impractical and counterproductive to their operational requirements, as air-gapping means physical isolation from networks.
• D. Rolling back to a previous architecture is a reactive and potentially disruptive measure that doesn't address the underlying security vulnerabilities or enhance the network's resilience against sophisticated, coordinated attacks.

Concept tested. Network segmentation for distributed systems security

Reference. https://learn.microsoft.com/en-us/azure/security/fundamentals/network-segmentation-best-practices

No community discussion yet for this question.