Lesson 10

Which of the following best describes the purpose of device hardening for endpoints like laptops and desktops?

• Deploying only legacy applications to reduce compatibility errors

• Minimizing the attack surface by removing or disabling unneeded services and software

• Installing as much software as possible to increase feature availability

• Limiting user access to the internet to avoid performance problems

A security architect wants to ensure that every device connecting to the corporate network meets a standardized security checklist for configuration (for example, ensuring certain ports are closed, USB devices are disabled, etc.). Which of the following mechanisms is designed to verify and remediate deviations from that checklist?

• Network segmentation

• Baseline configuration and deviation reporting

• Port mirroring

• Encryption at rest

An organization is worried about malware spreading laterally between workstations. The security team configures VLANs so that devices in the finance department are isolated from those in the marketing department. Which of the following describes this security strategy?

• Air gapping

• Network segmentation

• Zero-day containment

• Virtual patching

A systems administrator wants to guarantee that malicious or unauthorized scripts cannot run on corporate endpoints. The organization decides to only permit scripts that are explicitly approved. Which of the following describes this approach?

• Data loss prevention (DLP)

• Allow (whitelist) execution policy

• Mobile device management (MDM)

• Block (blacklist) execution policy

Which of the following is a benefit of full disk encryption (FDE) on a laptop?

• It eliminates the need for password-based authentication.

• It immediately blocks all incoming network connections by default.

• It protects data if the device is lost or stolen.

• It increases the speed of data access from the disk.

Which of the following is not typically managed by a mobile device management (MDM) solution?

• Enforcing screen lock and passcode settings

• Managing virtual machine operating system file permissions for server clusters

• Tracking devices and enforcing remote wipes

• Pushing application and OS updates to smartphones

A network administrator notices that the host-based intrusion detection system (HIDS) on a server is alerting on unusual changes to a critical system file. Which of the following features is the HIDS most likely using?

• A. File integrity monitoring (FIM)

• B. Honeypot logs

• C. Dynamic ARP inspection (DAI)

• D. Certificate pinning

An organization is concerned about unauthorized devices connecting to workstations via USB. They decide to restrict all USB mass storage devices at the operating system level. This control is an example of:

• Network intrusion prevention

• Physical segmentation

• Port and peripheral device hardening

• Social engineering awareness

Which of the following statements best differentiates Extended Detection and Response (XDR) from Endpoint Detection and Response (EDR)?

• XDR uses firewalls only, whereas EDR monitors user activity.

• EDR focuses on on-premises endpoints, while XDR only applies to cloud-based email systems.

• XDR correlates threats from endpoints, cloud services, and network telemetry, while EDR focuses primarily on endpoint activity.

• EDR always requires a third-party security operations center, whereas XDR is entirely in-house.

A company recently replaced multiple printers that contained built-in hard drives. Which of the following steps is most important to ensure no residual data remains on those decommissioned devices?

• Physically destroy the hard drives

• Update the printer firmware

• Reset the printers to factory settings

• Disconnect the printers from the network