CAS-003 · Question #792
A company is outsourcing to an MSSP that performs managed detection and response services. The MSSP requires a server to be placed inside the network as a log aggregate and allows remote access to…
The correct answer is C. Encryption of data in transit. The scenario explicitly calls out two data-in-transit vulnerabilities: (1) critical devices send cleartext logs to the log aggregator, and (2) the aggregator transmits data to the MSSP analysis server over port 80 (unencrypted HTTP). Both of these expose sensitive log data…
Question
A company is outsourcing to an MSSP that performs managed detection and response services. The MSSP requires a server to be placed inside the network as a log aggregate and allows remote access to MSSP analyst. Critical devices send logs to the log aggregator, where data is stored for 12 months locally before being archived to a multitenant cloud. The data is then sent from the log aggregate to a public IP address in the MSSP datacenter for analysis. A security engineer is concerned about the security of the solution and notes the following:
- The critical devise send cleartext logs to the aggregator.
- The log aggregator utilize full disk encryption.
- The log aggregator sends to the analysis server via port 80.
- MSSP analysis utilize an SSL VPN with MFA to access the log aggregator remotely.
- The data is compressed and encrypted prior to being achieved in the cloud.
Which of the following should be the engineer's GREATEST concern?
Options
- AHardware vulnerabilities introduced by the log aggregate server
- BNetwork bridging from a remote access VPN
- CEncryption of data in transit
- DMultinancy and data remnants in the cloud
How the community answered
(53 responses)- A4% (2)
- B19% (10)
- C66% (35)
- D11% (6)
Explanation
The scenario explicitly calls out two data-in-transit vulnerabilities: (1) critical devices send cleartext logs to the log aggregator, and (2) the aggregator transmits data to the MSSP analysis server over port 80 (unencrypted HTTP). Both of these expose sensitive log data - which may contain credentials, system events, and network details - to interception via man-in-the-middle attacks. Full disk encryption on the aggregator (data at rest) does not protect data while it is traversing the network. The SSL VPN with MFA for analyst remote access addresses one channel, but the log transmission path itself is unencrypted. This is the most actionable and clearly documented risk. Hardware vulnerabilities (A), VPN bridging (B), and multitenancy concerns (D) are valid but secondary compared to the explicitly unencrypted data paths identified.
Topics
Community Discussion
No community discussion yet for this question.