GSLC · Question #532
Victor works as a network administrator for DataSecu Inc. He uses a dual firewall Demilitarized Zone (DMZ) to insulate the rest of the network from the portions that is available to the Internet…
The correct answer is A. The attacker can exploit any protocol used to go into the internal network or intranet of the company. B. The attacker can perform a Zero Day attack by delivering a malicious payload that is not a part of the. DMZ protocol attacks allow exploitation of permitted protocols to reach internal networks and deliver zero-day payloads, but a dual-firewall DMZ prevents a first-firewall breach from directly exposing the internal network.
Question
Victor works as a network administrator for DataSecu Inc. He uses a dual firewall Demilitarized Zone (DMZ) to insulate the rest of the network from the portions that is available to the Internet. Which of the following security threats may occur if DMZ protocol attacks are performed? Each correct answer represents a complete solution. Choose all that apply.
Options
- AThe attacker can exploit any protocol used to go into the internal network or intranet of the company.
- BThe attacker can perform a Zero Day attack by delivering a malicious payload that is not a part of the
- CThe attacker can gain access to the Web server in a DMZ and exploit the database.
- DThe attacker managing to break the first firewall defense can access the internal network without
How the community answered
(58 responses)- A83% (48)
- C7% (4)
- D10% (6)
Why each option
DMZ protocol attacks allow exploitation of permitted protocols to reach internal networks and deliver zero-day payloads, but a dual-firewall DMZ prevents a first-firewall breach from directly exposing the internal network.
If an attacker exploits a protocol permitted through the DMZ such as HTTP or DNS, they can use that protocol as a covert channel to pivot toward the internal network or intranet, bypassing the intended segmentation of the DMZ.
A protocol-level attack through the DMZ can serve as a delivery mechanism for a zero-day exploit payload - malicious code for which no signature or patch yet exists - leveraging the trusted protocol channel to compromise systems inside the perimeter.
Gaining access to a web server in the DMZ and exploiting the database describes a web application or injection attack vector, not a DMZ protocol attack specifically, so it does not represent a threat caused by protocol-level exploitation of the DMZ.
In a dual-firewall DMZ architecture, successfully breaching the first firewall places the attacker only in the DMZ zone - a second independent firewall still separates the DMZ from the internal network, so the internal network is not directly accessible.
Concept tested: DMZ protocol attack threats in dual-firewall architecture
Source: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/secure-vnet-dmz
Topics
Community Discussion
No community discussion yet for this question.