CAS-003 · Question #747
A security analyst receives an email from a peer that includes a sample of code from a piece of malware found in an application running in the organization's staging environment. During the incident…
The correct answer is B. MFA for developer access. The kill chain here was: compromised laptop → credential harvesting → credentials used from a different system → bypass ACLs → access code repository → inject malware. The critical link was that stolen credentials alone were sufficient to access the repository. MFA…
Question
A security analyst receives an email from a peer that includes a sample of code from a piece of malware found in an application running in the organization's staging environment. During the incident response process, it is determined the code was introduced into the environment as a result of a compromised laptop being used to harvest credentials and access the organization's code repository. While the laptop itself was not used to access the code repository, an attacker was able to leverage the harvested credentials from another system in the development environment to bypass the ACLs limiting access to the repositories. Which of the following controls MOST likely would have interrupted the kill chain in this attack?
Options
- AIP whitelisting on the perimeter firewall
- BMFA for developer access
- CDynamic analysis scans in the production environment
- DBlue team engagement in peer-review activities
- ETime-based restrictions on developer access to code repositories
How the community answered
(49 responses)- A4% (2)
- B69% (34)
- C16% (8)
- D2% (1)
- E8% (4)
Explanation
The kill chain here was: compromised laptop → credential harvesting → credentials used from a different system → bypass ACLs → access code repository → inject malware. The critical link was that stolen credentials alone were sufficient to access the repository. MFA (Multi-Factor Authentication) for developer access (B) would have broken this chain: even with valid stolen credentials, the attacker would not have the second factor (e.g., a token or mobile app approval) required to authenticate. IP whitelisting (A) could help but would not stop an attacker already operating within the development network. Dynamic analysis in production (C) detects malware after the fact, not during injection. Blue team peer review (D) is a detection control, not a prevention control for credential misuse. Time-based restrictions (E) limit when access occurs but do not prevent a compromised credential from being used during allowed hours.
Topics
Community Discussion
No community discussion yet for this question.