Objective 2.5: Given a scenario, apply mitigation techniques to secure the enterprise
Cert: CompTIA Security+ (SY0-701) Domain: 2.0 Threats, Vulnerabilities, and Mitigations Weight: ~22% of SY0-701 (Domain 2 total) Depth: Apply. Be able to read a scenario, name the right mitigation, and map it to a NIST CSF (Cybersecurity Framework) function. Cover the ten general enterprise mitigations and the seven host hardening techniques in plain English.
What this objective tests
You should be able to read an incident or scenario, pick the strongest primary mitigation, and explain why. You also need to recognize host hardening steps when they appear on a workstation or server baseline, and you should know which NIST CSF function (Identify, Protect, Detect, Respond, Recover) each mitigation lives in. This is the most "apply level" objective in Domain 2. Threat actors, vectors, vulnerabilities, and indicators are all useless without mitigation, and every "Given a scenario" question on the exam wants a mitigation as the answer.
Key facts
The ten general enterprise mitigations
SY0-701 names ten general techniques that show up across networks, identity, applications, and operations. Memorize the list and one concrete example for each.
| Mitigation | Plain English | Where it lives in the stack |
|---|---|---|
| Segmentation | Split the network or system into zones so an attacker who lands in one zone cannot freely reach the others | Network (firewalls, VLANs, microsegmentation) |
| Access control (ACL and permissions) | Ordered allow and deny rules that decide who or what reaches a resource | Network ACLs on routers and switches, file and folder permissions on servers, IAM roles in cloud |
| Application allow list | Only approved applications may run. Anything not on the list is blocked. Formerly called whitelist | Endpoints, kiosks, servers, finance and OT workstations |
| Isolation | Cut a host, account, or process off from the network or from other systems | EDR isolation, quarantine VLAN, suspended account |
| Patching | Apply vendor updates that fix security flaws and bugs | Operating systems, firmware, applications, network devices |
| Encryption | Scramble data at rest and in transit so only someone with the key can read it | BitLocker, FileVault, LUKS, TLS, IPsec, SSH, database encryption |
| Monitoring | Watch systems and logs continuously so unusual activity is noticed and triaged | SIEM (Security Information and Event Management), EDR, log aggregation |
| Least privilege | Each user, service, and process gets only the rights it needs to do its job | Standard users without local admin, service accounts without domain admin, JIT (Just-In-Time) elevation |
| Configuration enforcement | Keep systems set up the way policy says they should be. Push back drift | Group Policy, Intune, Ansible, Puppet, Chef, AWS Config, Azure Policy |
| Decommissioning | Retire a system safely. Wipe data, revoke credentials, remove from inventory, update diagrams | End-of-life servers and workstations, retired cloud instances, replaced network gear |
The first four (segmentation, ACL/permissions, allow list, isolation) shape what can talk to what. Patching and encryption protect the systems themselves. Monitoring is the feedback loop. Least privilege and configuration enforcement keep the baseline honest. Decommissioning closes the loop at end-of-life.
Host hardening techniques
The objective also names seven techniques that turn a default install into a defended host. These are the steps a sysadmin walks before a new workstation or server ever sees a user.
- Encryption. Turn on full-disk encryption before the device leaves the IT room. BitLocker on Windows, FileVault on macOS, LUKS on Linux. Per-file or per-database encryption stacks on top where required.
- Install EDR (Endpoint Detection and Response). The modern replacement for signature-based antivirus. EDR watches behavior, blocks known bad activity, lets the SOC investigate live hosts, and feeds events into the SIEM.
- Host-based firewall. A firewall that runs on the host and filters traffic in and out of that one machine. Windows Defender Firewall, ufw, pf, iptables. Only allow inbound services this host actually needs.
- HIDS / HIPS (Host Intrusion Detection / Prevention System). A host agent that watches files, processes, and logs. HIDS detects. HIPS detects and blocks. Most modern EDR products include HIPS-style behavior. Some environments still pair them with a separate HIDS for compliance evidence.
- Disable unused ports and protocols. Turn off SMBv1, Telnet, unused inbound service ports, legacy authentication protocols. Smaller attack surface, fewer surprises.
- Default password changes. Every router, switch, IP camera, IoT device, and admin account gets its factory password changed before it touches the production network. The Mirai botnet that took out major DNS providers in 2016 was built almost entirely on devices that still had factory passwords.
- Removal of unnecessary software. Uninstall trial apps, games, bundled utilities, old runtimes. Every program is potential attack surface, and most production hosts ship with too much pre-installed.
Defense-in-depth
No single mitigation stops every attack. Defense-in-depth is the practice of stacking independent mitigations so an attacker has to defeat several in a row. Picture a phishing click landing on a finance workstation:
- Email filter quietly rates the message high risk but does not block it.
- The user clicks the link.
- The browser blocks the download. The user overrides.
- The host-based firewall sees no inbound connections to allow, but the malware uses an outbound HTTPS call.
- EDR sees the suspicious process inject into a system binary and blocks it.
- Monitoring fires a high-severity alert in the SIEM and the SOC pages on-call.
That is six layers and one click. The malware never executed cleanly. The cost of layering is paperwork and tuning. The cost of not layering is the breach post mortem.
The classic trap is treating defense-in-depth as "more is better." The actual rule is "independent is better." Two anti-malware products from the same vendor that share the same engine are one layer, not two. A VLAN segmentation with a flat rule of "any-any allow" between VLANs is one layer at most. Mitigations must have different failure modes to count as separate layers.
NIST Cybersecurity Framework (CSF)
The NIST CSF organizes all security work into five functions. Naming the function is the shortcut to the right answer on every "Given a scenario" question.
| Function | Plain English | Mitigations that live here |
|---|---|---|
| Identify | Know your assets, data, and risks | Asset inventory, risk assessment, gap analysis |
| Protect | Stop attacks from succeeding in the first place | Patching, encryption, least privilege, allow lists, ACLs, segmentation, hardening, configuration enforcement |
| Detect | Notice attacks as they happen | Monitoring (SIEM, EDR alerts, HIDS), threat hunting |
| Respond | Contain and stop attacks that get past Protect and Detect | Isolation, incident response runbooks, communication |
| Recover | Get the business back up and learn from the event | Backups, decommissioning of affected systems, lessons learned, document updates |
Most enterprise mitigations live in Protect. Monitoring lives in Detect. Isolation lives in Respond. Backups and post-incident decommissioning live in Recover. Identify is the function students forget on the exam, but inventory and asset management belong there, and a scenario about "we did not even know that server existed" maps straight to a missing Identify control.
Mitigation paired to the threat it counters
Scenario-style questions get easier when you pair each mitigation with the threat or risk it best handles.
| Threat or risky situation | Strongest primary mitigation |
|---|---|
| Ransomware spreading laterally on a flat network | Segmentation |
| New CVE on a network appliance with active exploitation | Patching |
| Old test server with default vendor password still online | Decommissioning |
| New help-desk hire given senior admin rights so they can "be ready" | Least privilege |
| Lost laptop holding exported client records | Encryption |
| User double-clicks an unknown installer from a phishing link | Application allow list (with EDR backup) |
| Drift detected: production web server is no longer on the approved baseline | Configuration enforcement |
| SIEM correlates failed login spike with one successful login from an unusual country | Monitoring |
| Confirmed compromise on a workstation needs containment now | Isolation |
| Auditor finds a service account with full domain admin rights | ACL and permissions (and least privilege) |
The exam loves to give you two plausible answers. Read the question for the word "primary" or "first." The strongest mitigation is the one that addresses the root cause of the scenario, not the one that catches the symptom.
Common gotchas
- Allow list vs. deny list. An allow list only permits approved apps. A deny list blocks specific known-bad apps and lets everything else run. Allow list is stricter and harder to bypass. The vocabulary shift (whitelist became allow list) is also on the exam.
- HIDS vs. HIPS. One letter, two behaviors. HIDS is detection only. HIPS detects and actively blocks. EDR usually includes HIPS-style behavior built in.
- Isolation is a response action, not a prevention. Pulling a host off the network with EDR is a Respond function in NIST CSF. It does not prevent the next attack. It contains this one.
- Encryption is not a malware control. Full-disk encryption protects confidentiality of data at rest. It does not stop a logged-in user's session from running malware. Calling encryption a "ransomware control" misses the point. Backups and EDR are the ransomware controls.
- Decommissioning is more than "shut it down." Wipe the data (cryptographic erase or DoD-style overwrite), revoke the credentials, remove from inventory, update the diagrams. A powered-off server with valid AD credentials is still a risk.
- Least privilege applies to service accounts too. Most environments lock down humans but leave service accounts with domain admin "just so it works." That is the path most ransomware groups take after initial access.
- Configuration enforcement is not change management. Change management (SP-1.3) approves the change. Configuration enforcement makes sure the system stays in its approved state after the change. The two are paired, not the same.
- Monitoring without tuning is not monitoring. A SIEM that fires 5,000 alerts a day teaches the SOC to ignore alerts. Tuning is part of the control.
- Defense-in-depth means independent layers. Two products from the same vendor that share an engine are one layer. Two VLANs with "any-any allow" between them are one VLAN.
Real-world context
In a SOC Tier 1 analyst seat, the mitigation vocabulary is the daily language. An EDR alert opens a ticket. The analyst reads the host details: which VLAN it sits in (segmentation), which user is signed in (AAA), what permissions that user has (least privilege), what processes EDR blocked (allow list and HIPS in action), and what the SIEM correlated (monitoring). The first decision is whether to isolate (Respond). The follow-up plan is whether the host needs patching, configuration enforcement, or decommissioning (Protect and Recover).
Sample alert walkthrough. The SIEM fires "Suspicious outbound DNS from FIN-WS-014 to a domain on the threat-intel deny list." The Tier 1 analyst opens the EDR console, confirms the process tree, and clicks isolate. That is Respond. Next, the analyst pulls the host's baseline state. BitLocker is on. EDR is current. The host-based firewall is enabled. But the application allow list is not enforced on the finance VLAN, and the user is in the local Administrators group. The post-incident plan writes itself: enforce the allow list on finance endpoints, remove local admin from accounts payable users, tighten segmentation so the finance VLAN cannot reach payroll directly. That is mitigation as a feedback loop.
Cyber insurance carriers now read mitigation evidence before renewing a policy. The underwriter sample includes EDR coverage percentage, MFA (Multi-Factor Authentication) coverage, patch cadence, default password elimination, and segmentation between corporate and OT networks. Premiums move with those numbers. Mitigation discipline is no longer "nice to have." It is a line item on the budget.
In a sysadmin seat, the same mitigation list runs in a different order. The host hardening checklist is the morning of every new device. Full-disk encryption on. EDR installed and enrolled. Host-based firewall enabled with the minimum inbound services. Default passwords changed. SMBv1 and Telnet off. Trial software uninstalled. The device joins the domain, picks up the Group Policy baseline (configuration enforcement), and ships to the user. The same checklist runs on every server, with a tighter allow list and a smaller open-port surface.
Sources
- CompTIA Security+ SY0-701 Exam Objectives, Section 2.5
- NIST Cybersecurity Framework (CSF) 2.0
- NIST SP 800-53 controls (AC Access Control, CM Configuration Management, SI System and Information Integrity families)
- CIS Critical Security Controls v8 (especially Controls 3, 4, 5, 6, 8, 11)
- Microsoft Security Compliance Toolkit baselines for Windows and Edge
- CISA "Stop Ransomware" guidance (segmentation, least privilege, EDR, backups)