SY0-701 Question 60
Single answer2.2 Explain common threat vectors and attack surfaces.A company recently moved several internal applications behind a reverse proxy and enabled remote access for third-party vendors through a VPN. Two weeks later, the security team discovers that a vendor's compromised laptop was used to access an exposed administrative web portal that should have been limited to internal IT staff. Which action would BEST reduce this attack surface while still allowing vendors to perform their job functions?
- A
Require all vendors to use the same shared VPN account so activity is easier to monitor
- B
Place the administrative portal on a segmented management network and restrict access through role-based access controls
- C
Disable TLS on the administrative portal so inspection tools can more easily read the traffic
- D
Publish the administrative portal to the internet with a web application firewall in front of it
Show answer and explanation
Correct answer: B
Explanation
The key concept is attack surface reduction. In this scenario, the problem is not simply that a laptop was compromised; it is that the compromised device could reach an administrative interface that was overly exposed through vendor remote access. The best mitigation is to reduce accessibility to that sensitive management plane by using network segmentation and enforcing least privilege through role-based access controls. This aligns with common security best practices from sources such as NIST guidance on access control and network segmentation, including the principles of least privilege and limiting administrative access paths. Reverse proxies, VPNs, and remote access solutions can improve functionality, but if administrative services are reachable by unnecessary users or networks, they become a larger attack surface and a more attractive threat vector.
- A. Incorrect.
This is incorrect. Shared VPN accounts weaken accountability and non-repudiation because multiple users appear as the same identity. They also make it harder to apply least privilege or quickly revoke access for a single vendor. A compromised shared credential expands the attack surface rather than reducing it.
- B. Correct.
This is correct. Segmenting the administrative portal onto a dedicated management network reduces its exposure, and role-based access controls ensure only authorized IT administrators can reach it. This directly addresses the attack surface problem by limiting network reachability and user access, while still allowing vendors to use the VPN for only the systems they need.
- C. Incorrect.
This is incorrect. Disabling TLS would expose credentials and session data to interception and would violate basic security best practices. While traffic inspection can be useful, the proper approach is to use approved TLS inspection or logging controls where appropriate, not to remove encryption from an administrative interface.
- D. Incorrect.
This is incorrect. A web application firewall can help protect web applications from some attacks, but publishing an administrative portal to the internet increases exposure and broadens the attack surface. Administrative interfaces should generally remain tightly restricted, especially when they are intended only for internal IT use.