An engineer must mitigate a recent zero-day vulnerability affecting RDP service where an attacker connects to a targeted system and sends crafted requests, followed by an arbitrary code execution…

Question

Options

• AImplement IDS to detect similar attacks in the future.
• BConfigure MAC Address Consistency Check in an ARP Packet.
• CConfigure blocking modes for session hijacking violations.
• DConfigure Network Level Authentication for Remote Desktop Services Connections.

• A
  4% (2)
• B
  11% (5)
• C
  4% (2)
• D
  81% (38)

Explanation

Network Level Authentication (NLA) forces users to authenticate before a full RDP session is established, meaning unauthenticated attackers cannot reach the vulnerable service layer to deliver crafted requests. Since the exploit chain requires the attacker to connect and interact with RDP, NLA acts as a pre-session gate that blocks the initial foothold - mitigating the vulnerability without disabling RDP entirely.

Why the distractors fail:

• A (IDS) only detects attacks after they occur; it does not block or prevent exploitation, so it fails the mitigation requirement.
• B (MAC Address Consistency / ARP) addresses ARP spoofing at Layer 2 and has no relevance to RDP session vulnerabilities or code execution via crafted packets.
• C (Session hijacking blocking) targets an already-established session being stolen by a third party - a different threat model entirely, unrelated to unauthenticated pre-session code execution.

Memory tip: Think of NLA as a "bouncer before the door" - attackers must prove identity before touching RDP's internals. Any zero-day that requires an active connection is defanged if the connection never fully forms. On the exam, when RDP + code execution + "can't disable" appear together, NLA is almost always the answer.

No community discussion yet for this question.