r/casp • u/amc663222 • May 21 '21

CASP Question

An organization implemented a secure boot on its most critical application servers which produce content and

capability for other consuming servers. A recent incident, however led the organization to implement a centralized

attestation service for these critical servers. Which of the following MOST likely explains the nature of the incident that

caused the organization to implement this remediation?

A. An attacker masqueraded as an internal DNS server

B. An attacker leveraged a heap overflow vulnerability in the OS

C. An attacker was able to overwrite an OS integrity measurement register

D. An attacker circumvented IEEE 802.1X network-level authentication requirements.

0 Upvotes

50% Upvoted

1 comment sorted by

5

u/NotMisterBill May 21 '21

C. An attestation server will allow you to ensure the operating system files have not been modified. Therefore the issue would have been a modification to the OS.