CompTIA CySA+ (CS0-003)Vulnerability ManagementMedium
A penetration tester is conducting an assessment of a corporate network. They gain initial access to a low-privilege workstation. Subsequently, they discover that the workstation has direct network connectivity to a segment containing critical database servers and management interfaces, which should have been isolated. This allows the tester to move from the compromised workstation directly to the sensitive database segment. Which security control, if properly implemented, would have best prevented this lateral movement?
- AEndpoint Detection and Response (EDR)
- BSecurity Information and Event Management (SIEM)
- CWeb Application Firewall (WAF)
- DNetwork Microsegmentation
Show answer & explanationAnswer & explanation
Correct answer: D. Network Microsegmentation
Network microsegmentation involves dividing a data center or cloud environment into distinct, isolated segments down to the workload level. This allows for fine-grained control over network traffic, preventing lateral movement between segments even if one workstation is compromised, precisely addressing the scenario described.
Why the other options are wrong
- A. EDR focuses on detecting and responding to threats on individual endpoints, not on preventing network lateral movement between segments.
- B. SIEM aggregates logs and events for analysis and alerting, but it doesn't inherently prevent network lateral movement; it would only detect it if configured to do so.
- C. A WAF protects web applications from attacks and is not designed to prevent lateral movement within an internal network infrastructure.
Network Microsegmentation
Network microsegmentation is a security technique that divides a network into small, isolated segments, allowing for granular control over traffic flow between individual workloads or applications.
- Limits lateral movement by attackers within a network.
- Enforces a 'least privilege' network access model.
- Often implemented using software-defined networking (SDN) or host-based firewalls.
Memory trick: Microsegmentation: Tiny segments, tiny paths – no easy lateral movement.