Security Hardening, Secure Boot and AD

What is the primary goal of security hardening?

• A) Increase system performance
  

• B) Make systems easier to use
  

• C) Reduce the system's attack surface
  

• D) Enhance system aesthetics

Which of the following is a common first step in system hardening?

• A) Installing antivirus software
  

• B) Disabling unnecessary services and ports
  

• C) Creating user accounts
  

• D) Defragmenting the hard drive

What is a key benefit of regularly updating software as part of security hardening?

• C) It increases system storage capacity
  

• B) It reduces the likelihood of vulnerabilities
  

• D) It enhances the speed of the system

• A) It improves user interface design
  

Which of the following practices helps in securing user accounts during system hardening?

• A) Using default passwords
  

• B) Implementing multi-factor authentication
  

• D) Sharing passwords among users

• C) Allowing unlimited login attempts
  

What is the purpose of disabling unused network ports in system hardening?

• C) To simplify network configuration
  

• B) To prevent unauthorized access
  

• A) To improve network speed
  

• D) To enhance data storage capabilities

You’re an IT administrator at a large enterprise. During a routine check, you discover a system booting with a non-signed bootloader. The system runs, but you're concerned about the risk. Which feature would help prevent this issue in the future?

• A) BIOS password protection
  

• B) Secure Boot
  

• C) Full disk encryption
  

• D) UEFI Shell access

A user downloads and runs a suspicious program. The program attempts to load a custom kernel-mode driver not signed by a trusted authority. What Windows feature will prevent this driver from executing?

• A) SmartScreen
  

• B) AppLocker
  

• C) Device Guard / Code Integrity
  

• D) BitLocker

Your development team is testing a new driver on Windows 11. It's signed with an internal test certificate, but Windows refuses to load it, citing driver signing policies. What must be done for the code to run temporarily on a test system without disabling security for all users?

• A) Disable Secure Boot
  

• B) Enable Test Signing mode
  

• C) Run as Administrator
  

• D) Use Group Policy to bypass signing

An attacker attempts to bypass Secure Boot by exploiting UEFI firmware to insert a malicious bootloader. What countermeasure would most effectively detect or prevent such a compromise?

• A) BitLocker with TPM
  

• B) BIOS-level password
  

• C) Secure Boot with TPM-backed attestation
  

• D) Disabling fast startup

Your company requires certain internally-developed applications and drivers to run on employee laptops. These apps are signed, but not by Microsoft. Which strategy ensures both security and functionality without compromising Secure Boot or Code Integrity?

• A) Disable Code Integrity
  

• B) Use self-signed certificates and disable enforcement
  

• C) Enroll the company's code signing certificate in the UEFI firmware and Windows Trust Store
  

• D) Whitelist executables manually in registry