GCIH · Question #738
Which of the following actions can prevent the successful use of Metasploit against a Windows host?
The correct answer is D. Deploy an allowlist. Application allowlisting blocks any executable not on an approved list from running, which directly prevents Metasploit payloads and stagers from executing on the host.
Question
Which of the following actions can prevent the successful use of Metasploit against a Windows host?
Options
- ADeploy User and Entity Behavior Analytics (UEBA) tools
- BDeploy XSS protection
- CMonitor Windows Event IDs associated with failed logins
- DDeploy an allowlist
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C8% (2)
- D80% (20)
Why each option
Application allowlisting blocks any executable not on an approved list from running, which directly prevents Metasploit payloads and stagers from executing on the host.
UEBA tools analyze behavioral baselines and raise alerts after anomalous activity is detected, but they do not prevent an unauthorized executable from launching in the first place.
XSS protection defends web applications against cross-site scripting injection and has no relevance to blocking binary payloads executed on a Windows endpoint.
Monitoring failed login Event IDs helps detect credential-based attacks but does not block Metasploit exploits or payloads that do not depend on authentication failures.
An allowlist policy - implemented via tools like Windows Defender Application Control or AppLocker - restricts execution to explicitly pre-approved binaries. Metasploit-generated payloads, meterpreter stagers, and shellcode loaders are unknown executables not on the approved list, so they are blocked from running before they can establish a foothold or escalate privileges.
Concept tested: Application allowlisting to block exploit framework payloads
Source: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview
Topics
Community Discussion
No community discussion yet for this question.