A red team is able to connect a laptop with penetration testing tools directly into an open network port. The team then is able to take advantage of a vulnerability on the domain controller to…

Question

Options

• AMonitor for anomalous creations of privileged domain accounts
• BInstall a NIPS with rules appropriate to drop most exploit traffic
• CEnsure the domain controller has the latest security patches
• DImplement 802.1X with certificate-based authentication

• A
  6% (1)
• B
  6% (1)
• C
  78% (14)
• D
  11% (2)

Explanation

The attack succeeded because the domain controller had an unpatched vulnerability - that vulnerability IS the attack vector. Patching the DC (C) directly eliminates it. Option D (802.1X) would address the open network port by requiring certificate-based authentication before a device can join the network, which is a strong compensating control for the physical access problem, but it does not remove the DC vulnerability itself - a legitimate user on the same network could still exploit it. Option A (monitoring) is detective, not preventive, and would not stop the attack. Option B (NIPS) might block known exploit signatures but cannot guarantee elimination of the vulnerability. Because the question asks what would 'eliminate this attack vector,' the most direct answer is patching the vulnerability that enabled the privilege escalation.

No community discussion yet for this question.