Chapter 11: Endpoint Security

Lin's hardware manufacturer has stopped selling the model of device that Lin's organization uses and has also stopped providing security or other updates. What phase of the hardware life cycle is the device in?

• End-of-life

• Legacy

• End-of-sales

• Senescence

Answer explanation

Key Phrase: "has stopped selling the model"

Explanation:
Correct Answer (B): Legacy hardware is unsupported and no longer sold. It is in the legacy phase, meaning the device is no longer being sold, and it may no longer receive updates.
Why others are wrong:

• A: End-of-life typically means the device is no longer being made but still may have support for a period of time.

• C: End-of-sales refers to when the device stops being sold, but this doesn't mean it is unsupported yet.

• D: Senescence is not a term commonly used in hardware life cycles.

Naomi has discovered the following TCP ports open on a system she wants to harden. Which ports are used for unsecure services and thus should be disabled to allow their secure equivalents to continue to be used?

• 21, 22, and 80

• 21 and 80

• 21, 23, and 80

• 22 and 443

Answer explanation

Key Phrase: "unsecure services"

Explanation:
Correct Answer (C): Ports 21 (FTP), 23 (Telnet), and 80 (HTTP) are all used for unsecure services. Naomi should disable these services and use their secure equivalents (FTP/S, SSH, and HTTPS).
Why others are wrong:

• A: Port 22 (SSH) and Port 443 (HTTPS) are secure services and do not need to be disabled.

• B: Port 21 (FTP) and Port 80 (HTTP) are unsecure but Port 22 (SSH) is secure and does not need to be disabled.

• D: Port 22 (SSH) and Port 443 (HTTPS) are secure, so disabling them would be counterproductive.

Frank's organization is preparing to deploy a data loss prevention (DLP) system. What key process should they undertake before they deploy it?

• Define data lifecycles for all non-sensitive data.

• Encrypt all sensitive data.

• Implement and use a data classifications scheme.

• Tag all data by creator or owner.

Answer explanation

Key Phrase: "before they deploy it"

Explanation:
Correct Answer (C): A data classification scheme is essential for a DLP system to know which data should be protected and what policies to apply to it.
Why others are wrong:

• A: Defining data lifecycles is important for data management but is not a required step in a DLP deployment.

• B: Encrypting all sensitive data may interfere with DLP’s ability to monitor it.

• D: Tagging all data by creator or owner is useful but not as critical as classifying the data first.

Oliver wants to store and manage secrets in his cloud service provider's environment. What type of solution should he look for as part of their offerings?

• ATPM

• A secure enclave

• A KMS

• A Titan M

Answer explanation

Key Phrase: "store and manage secrets"

Explanation:
Correct Answer (C): A Key Management System (KMS) is designed to securely create, store, and manage cryptographic keys and secrets in cloud environments.
Why others are wrong:

• A: ATPM (Application Threat and Protection Management) is not the correct solution for managing secrets.

• B: A secure enclave is a hardware-based solution for securing data but does not fit the requirement for managing secrets in a cloud environment.

• D: A Titan M is a hardware module designed for secure key storage in devices, not for cloud-based secret management.

What is the key difference between EDR and XDR solutions?

• The variety of malware it can detect

• The number of threat feeds that are used

• The breadth of the technology stack that is covered

• The volume of logs that can be processed

Answer explanation

Key Phrase: "key difference between EDR and XDR"

Explanation:
Correct Answer (C): XDR solutions cover a broader technology stack, including endpoints, cloud services, and other security platforms, whereas EDR is more focused on endpoint detection and response.
Why others are wrong:

• A: The variety of malware detected is not the primary distinguishing factor between EDR and XDR.

• B: The number of threat feeds is not a key differentiator for EDR and XDR.

• D: The volume of logs processed is related to the performance of the solution but not the key difference between EDR and XDR.

Michelle wants to prevent unauthorized applications from being installed on a Windows system. What type of tool can she use to stop applications from being installed?

• Antivirus

• A GPO

• An EDR

• A HIPS

Answer explanation

Key Phrase: "prevent unauthorized applications"

Explanation:
Correct Answer (B): A Group Policy Object (GPO) can be used to control whether users are able to install software on Windows systems.
Why others are wrong:

• A: Antivirus software is designed to detect and remove malicious applications but doesn't control installation permissions.

• C: EDR (Endpoint Detection and Response) systems focus on detecting and responding to threats, not blocking application installations.

• D: HIPS (Host-based Intrusion Prevention Systems) primarily monitors and prevents attacks, not application installations.

What term is used to describe tools focused on detecting and responding to suspicious activities occurring on endpoints like desktops, laptops, and mobile devices?

• EDR

• IAM

• FDE

• ESC

Answer explanation

Key Phrase: "detecting and responding to suspicious activities on endpoints"

Explanation:
Correct Answer (A): EDR (Endpoint Detection and Response) tools focus on detecting and responding to suspicious activities and threats occurring on endpoints such as desktops, laptops, and mobile devices.
Why others are wrong:

• B: IAM (Identity and Access Management) focuses on managing identities and permissions, not endpoint activity.

• C: FDE (Full-Disk Encryption) is used to encrypt data on disks, not to monitor endpoint activity.

• D: ESC (Endpoint Security Control) is not a commonly used acronym.

Fred has recently purchased a network router and is preparing to deploy it. Which of the following is a common step in deploying new routers?

• Disabling unwanted services

• Removing unnecessary software

• Installing antivirus

• Changing default passwords

Answer explanation

Key Phrase: "deploying new routers"

Explanation:
Correct Answer (D): A critical step when deploying a new network router is to change the default passwords to prevent unauthorized access.
Why others are wrong:

• A: Disabling unwanted services is good practice but may not be the first step in setting up a new router.

• B: Removing unnecessary software is typically not applicable to routers, as they are not often running additional software.

• C: Installing antivirus is not necessary for a router as it is a network device, not an endpoint.

Charlene wants to prevent attacks against her system that leverage flaws in the services that it provides while still keeping the services accessible. What hardening technique should she use?

• A host-based firewall

• A host-based IPS

• Encryption

• An EDR

Answer explanation

Key Phrase: "prevent attacks against her system, flaws in the services, accessible"

Explanation:

• Correct Answer (B): A host-based IPS (Intrusion Prevention System) can detect and prevent attacks against services while allowing the services to remain accessible.

• Why others are wrong:

  • A: A host-based firewall could block legitimate traffic and might not specifically address flaws in the services.

  • C: Encryption does not prevent attacks targeting service vulnerabilities.

  • D: EDR (Endpoint Detection and Response) is primarily for detecting malware or malicious activity rather than protecting services from network-based attacks.

Allan is preparing to harden his organization's network switches. Which of the following is not a common hardening technique for network devices?

• Removing unnecessary software

• Installing patches

• Administrative VLANs

• Changing default passwords

Answer explanation

Key Phrase: "hardening network switches"

Explanation:

• Correct Answer (A): Network switches typically do not have additional software that can be removed compared to systems like servers or workstations.

• Why others are wrong:

  • B: Installing patches is a common practice to secure network devices.

  • C: Administrative VLANs are used to separate management traffic from user data, enhancing security.

  • D: Changing default passwords is a basic security measure to prevent unauthorized access to network devices.