A penetration test finds that an attacker who compromised a single workstation in the finance VLAN was able to directly reach domain controllers, file servers, and HR systems over SMB because all hosts shared the same flat broadcast domain with no internal traffic restrictions. Which mitigation would most effectively reduce the blast radius of a similar compromise in the future?
- AAdd the compromised workstation to the vulnerability scanner's exception list
- BEnable non-credentialed scanning on the finance VLAN to identify open ports
- CImplement network microsegmentation with host-based firewall rules restricting east-west SMB traffic between unrelated systems
- DRaise the internal CVSS scoring threshold required to classify a finding as critical
Show answer & explanationAnswer & explanation
Correct answer: C. Implement network microsegmentation with host-based firewall rules restricting east-west SMB traffic between unrelated systems
The root cause is unrestricted lateral (east-west) connectivity across the flat network. Microsegmentation with host-based firewall rules enforces least-privilege network access between systems, so a compromised finance workstation can no longer freely reach domain controllers or HR servers, directly limiting the blast radius of future compromises.
Why the other options are wrong
- A. Excluding a host from scanning would hide findings rather than reduce actual risk.
- B. Scanning identifies exposure but does not itself prevent lateral movement.
- D. Changing scoring thresholds doesn't restrict network access or reduce lateral movement risk.
Network Microsegmentation
A mitigation technique that divides a network into small, tightly controlled zones with enforced access policies (often via host-based or software-defined firewalls), limiting lateral movement between systems that do not need to communicate.
- Reduces blast radius after a single host is compromised
- Enforces least-privilege network communication, not just perimeter defense
- Often implemented via VLANs plus host firewalls or software-defined networking (SDN)
Memory trick: Microsegmentation turns one big open office into locked individual rooms.