English
Menu

Cyber Attacks and Defense in Practice

Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?

  1. AGiving each PC a different local administrator password and blocking unnecessary traffic between PCs (such as file sharing)
  2. BTo reduce administrative effort, setting the local administrator password of all PCs to the same long, complex value
  3. CTightening the rules of the firewall at the internet perimeter and restricting only the traffic coming into the company from outside in even finer detail
Show answer and explanation

Answer: A. Giving each PC a different local administrator password and blocking unnecessary traffic between PCs (such as file sharing)

An intruder steals credentials from the hijacked PC and connects one after another to other PCs and servers where those credentials work, getting closer to important systems. If all PCs use the same local administrator password, information stolen from one PC is enough to get into all of them, so mechanisms that automatically set a different value on each PC (such as Windows LAPS) are used. In addition, PCs normally have no need for file-sharing or remote-administration traffic between each other, so blocking that traffic with network or host firewalls and limiting traffic between servers to what is needed (micro-segmentation) reduces the spread of a compromise. Perimeter defenses cannot stop an attacker who is already inside from moving around internally (east-west traffic).

  • A. Correct. It cuts off both the reuse of stolen credentials and unnecessary internal paths.
  • B. However complex, the same value lets an attacker into every PC once it is stolen from one.
  • C. Perimeter rules prevent intrusion from outside and cannot stop an attacker who is already inside from moving around.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?
  2. Which of the following correctly describes access control based on the idea of zero trust?
  3. The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?
  4. Which of the following correctly compares a traditional remote-access VPN with ZTNA (zero trust network access) as ways for remote employees to use internal systems?
  5. Which of the following correctly describes EDR (endpoint detection and response) compared with traditional antivirus software?

Comparisons in this topic