CS0-003 · Question #495
A manufacturing company's assembly line machinery only functions on an end- of-life OS. Consequently, no patches exist for several highly exploitable OS vulnerabilities. Which of the following is…
The correct answer is A. Enforce strict network segmentation to isolate vulnerable systems from the production network. When systems run end-of-life operating systems with unpatchable vulnerabilities, strict network segmentation is the best mitigating control to isolate them and prevent exploitation from other parts of the network.
Question
A manufacturing company's assembly line machinery only functions on an end- of-life OS. Consequently, no patches exist for several highly exploitable OS vulnerabilities. Which of the following is the best mitigating control to reduce the risk of these current conditions?
Options
- AEnforce strict network segmentation to isolate vulnerable systems from the production network.
- BIncrease the system resources for vulnerable devices to prevent denial of service.
- CPerform penetration testing to verify the exploitability of these vulnerabilities.
- DDevelop in-house patches to address these vulnerabilities.
How the community answered
(38 responses)- A79% (30)
- B13% (5)
- C5% (2)
- D3% (1)
Why each option
When systems run end-of-life operating systems with unpatchable vulnerabilities, strict network segmentation is the best mitigating control to isolate them and prevent exploitation from other parts of the network.
Strict network segmentation isolates vulnerable systems from the rest of the network, creating a security zone that limits their exposure. This significantly reduces the attack surface and prevents adversaries from easily reaching and exploiting these unpatched, end-of-life systems from other segments or the internet, thereby containing potential breaches.
Increasing system resources might improve performance or resilience against basic denial-of-service attacks but does not address the underlying OS vulnerabilities or prevent their exploitation.
Performing penetration testing verifies exploitability but does not mitigate the risk; it's a testing activity, not a control.
Developing in-house patches for an end-of-life OS is often impractical, costly, and requires specialized knowledge, making it an unrealistic and unsustainable solution for most organizations.
Concept tested: Mitigating risks for end-of-life systems via network segmentation
Source: https://learn.microsoft.com/en-us/azure/architecture/guide/security/security-governance-compliance-vulnerabilities#identify-and-segment-risky-assets
Topics
Community Discussion
No community discussion yet for this question.