A company monitors the performance of all web servers using WMI. A network administrator informs the security engineer that web servers hosting the company's client- facing portal are running slowly…

Question

Options

• AInstall a HIPS on the web servers
• BDisable inbound traffic from offending sources
• CDisable SNMP on the web servers
• DInstall anti-DDoS protection in the DMZ

• A
  75% (24)
• B
  6% (2)
• C
  6% (2)
• D
  13% (4)

Explanation

The web servers are being targeted by SNMP enumeration from multiple IP addresses as a reconnaissance technique. Installing HIPS (Host Intrusion Prevention System) on the web servers is the best answer because HIPS actively monitors and blocks malicious traffic patterns - including unauthorized SNMP enumeration - at the host level in real time, and provides protection against a broad range of reconnaissance and exploitation techniques beyond just SNMP. Blocking specific source IPs (B) is a temporary measure since attackers can rotate addresses and this does not scale against a multi-IP campaign. Disabling SNMP (C) would eliminate the attack vector directly but could disrupt legitimate network management that may rely on SNMP; also, the question asks about preventing reconnaissance broadly. Anti-DDoS (D) addresses volumetric attacks, not low-and-slow reconnaissance enumeration. HIPS provides proactive, host-level defense without requiring service disruption.

No community discussion yet for this question.