212-82: Certified Cybersecurity TechnicianDemo

By ECCouncil · Question Mode

QuestionQ86

Incident and Risk Management

As chief cybersecurity officer for a multi-national satellite communications company, you recently moved to a more advanced architecture that includes multiple ground stations located around the world. These stations synchronize and communicate through a central hub that manages the distribution of encrypted data across the network.

While reviewing the quarterly network logs, you discover a series of sophisticated intrusions occurring intermittently at ground stations on three different continents. Evidence indicates that these attacks are coordinated and are aimed at mapping the network's communication paths, likely as preparation for a larger-scale cyber-attack. Further investigation reveals small pockets of malware within the system that are specifically designed to bypass your existing security controls.

Given the critical importance of maintaining uninterrupted satellite communications, which countermeasure would be most effective at:

  • Thwarting these intrusions
  • Ensuring data integrity
  • Maintaining the operational status of your satellite communication systems
  • A Enhance end-point security solutions at each ground station, focusing on advanced malware detection, eradication, and prevention.
  • B Implement air-gapped systems for each ground station to ensure complete isolation, minimizing the risk of malware spread and external intrusions.
  • C Deploy an advanced network segmentation strategy, ensuring each ground station operates in a micro-segmented environment, with real-time threat monitoring and dynamic policy adjustments.
  • D Rollback the system to its previous architecture, while launching a thorough investigation into the identified intrusions and taking the necessary legal actions.
Explanation

Because the intrusions are coordinated across geographically dispersed ground stations and are focused on mapping communication paths (reconnaissance) in preparation for a larger attack, the priority is to limit an attacker's ability to move laterally and observe network topology while still detecting and adapting to threats in real time. Micro-segmentation isolates each ground station (or subsets of its systems) into distinct security zones, so a compromise or reconnaissance attempt in one segment cannot easily reveal or reach other segments, directly countering network-mapping activity. Combined with real-time threat monitoring and dynamic policy adjustments, this approach allows the security team to detect anomalous behavior (such as the identified evasive malware) and adjust access controls on the fly without severing the legitimate, continuous synchronization required through the central hub. This preserves operational continuity — unlike air-gapping, which would break the required centralized communication and coordination — while providing stronger containment and visibility than endpoint security alone, and without the disruption and lost forensic/operational continuity of a full architecture rollback.

Community Discussion

No comments yet. Be the first to start the discussion!