Exam PT0-001 topic 1 question 21 discussion

I'm going with CDE. G could be a contender but putting each host on a separate VLAN seems like overkill to me.

I believe C, D, E are the correct answers.

A. Randomize local administrator credentials for each machine: This will make it harder for an attacker to move laterally if they compromise a single workstation since the credentials will be different for each machine. C. Require multifactor authentication for all logins: This will add an extra layer of security to the login process, making it harder for attackers to gain unauthorized access to the network. G. Segment each host into its own VLAN: This will prevent an attacker from easily moving laterally throughout the network, as they will need to compromise each host individually to gain access to other parts of the network.

looks good to me

ACE plase don't give answers uless you are sure, cause you only cause more confusion A. Randomize local administrator credentials for each machine. - good, LAPS "Local Admin Password Solution" B. Disable remote logons for local administrators. - wrong, netadmins always need access and thats why you have LAPS C. Require multifactor authentication for all logins. - good, direct counter D. Increase minimum password complexity requirements. - wrong, once password is known its complexity doesn't matter E. Apply additional network access control. - good, similarly to MFA F. Enable full-disk encryption on every workstation. - wrong, protects only data at rest G. Segment each host into its own VLAN. - ridicules

A. Randomize local administrator credentials for each machine. - Good aswer - there are tools which allow to manage randomizing administrator credentials. B. Disable remote logons for local administrators. - Wrong answer - administrators needs remote access C. Require multifactor authentication for all logins. - Good answer D. Increase minimum password complexity requirements. - Wrong answer - there is nothing about password in question. Usually access to other system is granted by grabbing hashes. E. Apply additional network access control. - Not sure, but I think that this answer is correct. F. Enable full-disk encryption on every workstation. - Wrong answer - disk encryption would help when PC is off, not when it is in network G. Segment each host into its own VLAN. - Wrong answer - too much effort

As you prepare for the exam, keep these findings and recommended remediation strategies in mind. There are many ways that you can mitigate each of the findings described next, but you should remember that the mitigation strategies discussed in this chapter are the preferred methods identified by CompTIA. For example, if you see an exam question asking you the “best” way to mitigate a finding, you should definitely look first for the CompTIA recommended strategy among the answer choices! So guys, what Comptia recommends is to look at people, process and technology and decide which answer suits the best rather than going on line and searching for mitigation strategies. Comptia has a whole objective 5.3 Given a scenario, recommend mitigation strategies for discovered vulnerabilities dedicated to this and read this

Possible Mitigations/Solutions for a Shared Local Administrator Finding People :Train support staff not to reuse passwords across account wherever possible Process: Require randomization of passwords using password generation algorithms for privileged accounts Technology :Implement technology such as LAPS,SHIPS or other password management technology to ensure that passwords are not shared across endpoints. Comptia pentest + passport book

In the industry, solutions are popularly divided into three categories: people, process, and technology. The driving logic is that all solutions involve each of these categories together. While the documentation included in reports does not necessarily need to follow this convention exactly, it is helpful when thinking about how to research and recommend solutions. Generally, people-based solutions focus on culture and the capabilities of people rather than technology or business practices. Process-based solutions focus on policies, procedures, and processes—or how people and technology work, rather than their capabilities. Technology-based solutions are those that drive or are driven by the implementation of technology.

B, C, E the local admin passwords can be used for pass the hash on other devices that have the same local password. source: https://docs.microsoft.com/en-us/troubleshoot/sql/security/block-remote-use-local-accounts Everyone seems to be in agrement on C, E

The answer is CDE

B. Disable remote logons for local administrators C. Require multifactor authentication for all logins E. Apply additional network access control

My two pennies worth: If we are all in agreement about C and D (I can't see how anyone would think that A and B would be the BEST options. Try telling local IT to administer their network without the fall-back of local admin accounts...) then it's E, F or G. Again, could anyone suggest to management that putting EVERY host into its own VLAN. The complexity created would be a nightmare to administer and would really create its own security hole I can't agree with the full-disk encryption idea if we agree that the idea is that the data is encrypted at rest. If you're in the box then the hashes are going to be accessed via the OS, so not encrypted Answer E is a bit vague but I think covers enough stuff not to be wrong. So it's CDE for me. And here's a good article that I found helpful https://www.ncsc.gov.uk/guidance/preventing-lateral-movement

Man this one is tough. There is just so much missing info. C and D are definitely correct. I could see A being correct, because it says the adversary is able to move laterally with minimal issue. Could be a common local admin account that he is exploiting... E could be correct, as it would add another password that would need to be broken for access. I could also see G being correct (Zero trust model would micro-segment the network to help stop lateral movement of malware/etc.) ------- With all that said, I would lean towards the Sybex answer, as they obviously had a play in crafting this question.

So what is the conclusion?

G must be involved in as the top solution

I would go with C, D, G. I believe that the reason the attacker was able to move laterally without any obstacles is because all the hosts were on the same network. It takes more work to move laterally if these compromised hosts were on different networks. To accomplish such a task, a virtual LAN (VLAN) needs to be implemented. This would make each host look like they are on they own separate network. Thus, when the attacker compromises the initial host, the others won't be readily available or seen.