2.5 Mitigation techniques explained

Objective 2.5 moves from attacks to defences. The exam lists a set of enterprise mitigation techniques and expects you to know what each one is for, so that you can pick the best one for a described problem.

Segmentation divides a network into zones so that a compromise in one zone can't reach everything else. Access control limits who can reach what, using access control lists and permissions. An application allow list lets only approved software run and blocks everything else by default, which stops unknown malware even without a signature. Isolation moves a suspect or compromised system somewhere it can't talk to the rest of the network, often while keeping it reachable by security tools.

Patching closes known vulnerabilities, and it works best as a routine process with testing, not a scramble. Encryption protects data if it is stolen or intercepted. Monitoring watches for signs that other controls have failed. Least privilege gives every user and service only the access it needs, which limits the damage from any single compromised account.

Configuration enforcement keeps systems at their approved secure baseline. Over time administrators make one-off changes and systems drift; enforcement tools detect and correct that drift automatically. Decommissioning removes systems that are no longer needed, because a forgotten server with old software is an easy target.

Hardening techniques form the last group. They include encryption, installing endpoint protection, using a host-based firewall, a host-based intrusion prevention system, disabling ports and protocols that aren't needed, changing default passwords and removing unnecessary software. Each one reduces the attack surface of a single system.

Exam questions here usually describe a constraint. A kiosk must only run three programs: that is an allow list. A server can't be patched this quarter: segmentation and monitoring around it. Servers keep drifting from the baseline: configuration enforcement. Malware has been confirmed on a laptop and the team needs to stop it spreading before cleanup: isolation. Read the scenario for the one requirement that matters most, then match it to the technique built for that job.

These techniques are layered. No one of them is enough; together they make an attacker's job slower and noisier at every step, which is the point of defence in depth.