hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: During a penetration test, a tester successfully…
During a penetration test, a tester successfully exploits a vulnerability in a web application and gains a shell on the backend server. The tester then attempts to pivot to other hosts. Which of the following security controls would be most effective in limiting lateral movement in this scenario?
⚠ Common exam trap
CompTIA often tests the misconception that endpoint controls like HIPS or application whitelisting are sufficient to stop lateral movement, but the trap here is that once an attacker has a shell, they can often bypass or disable host-based controls, whereas network segmentation is a preventive control that operates independently of the compromised host's state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network segmentation with strict firewall rules
Network segmentation with strict firewall rules (C) is the most effective control because it directly restricts the ability of an attacker who has compromised one host to initiate connections to other hosts. By enforcing least-privilege network access between segments (e.g., using VLANs and ACLs), lateral movement techniques such as port scanning, SMB relay, or RDP brute force are blocked at the network layer, regardless of the attacker's shell access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Host-based intrusion prevention system (HIPS)
Why it's wrong here
A Host-based Intrusion Prevention System (HIPS) operates on individual endpoints, monitoring system calls, file access, and network traffic originating from or destined for that specific host. While effective at preventing initial compromise or local privilege escalation, a HIPS might not detect or block lateral movement that leverages legitimate credentials or trusted protocols between already compromised internal systems, especially if the HIPS on the target host is bypassed or the movement originates from an already trusted, compromised internal system.
- ✗
Full disk encryption
Why it's wrong here
Full disk encryption (FDE) secures data by encrypting the entire storage volume, protecting information from unauthorized access if the physical device is lost or stolen. However, FDE is irrelevant once a system is booted and operational, as the data is decrypted in memory and accessible to the operating system and any processes running on it. Therefore, it offers no protection against an attacker who has already gained network access to a running system and is attempting lateral movement.
- ✓
Network segmentation with strict firewall rules
Why this is correct
Network segmentation logically divides a network into smaller, isolated subnets, significantly limiting direct communication paths between different security zones. When combined with strict firewall rules that enforce a "deny by default" policy and only permit explicitly authorized traffic, this architecture severely restricts an attacker's ability to move laterally from a compromised host in one segment to other critical systems in different segments, thereby containing breaches and hindering further compromise.
- ✗
Application whitelisting
Why it's wrong here
Application whitelisting is a security control that permits only explicitly authorized applications or executables to run on a system, effectively preventing the execution of malicious or unauthorized software. While excellent for preventing malware execution and initial compromise, it does not inherently restrict network-level communication or prevent an authorized, but compromised, application from being used to facilitate lateral movement if network pathways are open and not governed by other controls.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.