WorksheetsSecurity Hardening, Secure Boot and AD
Total questions: 14
Worksheet time: 7mins
What is the primary goal of security hardening?
A) Increase system performance
B) Make systems easier to use
C) Reduce the system's attack surface
D) Enhance system aesthetics
Which of the following is a common first step in system hardening?
A) Installing antivirus software
B) Disabling unnecessary services and ports
C) Creating user accounts
D) Defragmenting the hard drive
What is a key benefit of regularly updating software as part of security hardening?
C) It increases system storage capacity
B) It reduces the likelihood of vulnerabilities
D) It enhances the speed of the system
A) It improves user interface design
Which of the following practices helps in securing user accounts during system hardening?
A) Using default passwords
B) Implementing multi-factor authentication
D) Sharing passwords among users
C) Allowing unlimited login attempts
What is the purpose of disabling unused network ports in system hardening?
C) To simplify network configuration
B) To prevent unauthorized access
A) To improve network speed
D) To enhance data storage capabilities
You’re an IT administrator at a large enterprise. During a routine check, you discover a system booting with a non-signed bootloader. The system runs, but you're concerned about the risk. Which feature would help prevent this issue in the future?
A) BIOS password protection
B) Secure Boot
C) Full disk encryption
D) UEFI Shell access
A user downloads and runs a suspicious program. The program attempts to load a custom kernel-mode driver not signed by a trusted authority. What Windows feature will prevent this driver from executing?
A) SmartScreen
B) AppLocker
C) Device Guard / Code Integrity
D) BitLocker
Your development team is testing a new driver on Windows 11. It's signed with an internal test certificate, but Windows refuses to load it, citing driver signing policies. What must be done for the code to run temporarily on a test system without disabling security for all users?
A) Disable Secure Boot
B) Enable Test Signing mode
C) Run as Administrator
D) Use Group Policy to bypass signing
An attacker attempts to bypass Secure Boot by exploiting UEFI firmware to insert a malicious bootloader. What countermeasure would most effectively detect or prevent such a compromise?
A) BitLocker with TPM
B) BIOS-level password
C) Secure Boot with TPM-backed attestation
D) Disabling fast startup
Your company requires certain internally-developed applications and drivers to run on employee laptops. These apps are signed, but not by Microsoft. Which strategy ensures both security and functionality without compromising Secure Boot or Code Integrity?
A) Disable Code Integrity
B) Use self-signed certificates and disable enforcement
C) Enroll the company's code signing certificate in the UEFI firmware and Windows Trust Store
D) Whitelist executables manually in registry
During a security audit, you discover that an attacker who compromised a standard user account is querying the AD for domain admin accounts and accessing other systems. Which security best practice would most effectively limit this type of lateral movement?
A) Use only one domain admin account for the whole organization
B) Store admin credentials in Group Policy Objects (GPOs)
C) Implement Tiered Administration and Privileged Access Workstations (PAWs)
D) Disable account lockout policies to reduce disruptions
You receive alerts that multiple failed logins from one IP address are targeting many AD accounts. This activity resembles a password spraying attack. What AD security feature can help mitigate this threat?
A) DNS scavenging
B) Fine-Grained Password Policies
C) Account Lockout Policy
D) LDAP signing
Your security team wants to protect domain admins from phishing attacks and credential theft. Which solution would provide the best defense against compromised credentials?
A) Disable all email access for domain admins
B) Require smart card authentication and restrict logon to secure devices
C) Only allow domain admins to use their credentials over VPN
D) Implement time-based restrictions for login hours
You find that many legacy service accounts in AD have never had their passwords changed and have excessive permissions. What is the most secure approach to mitigate the risks these accounts pose?
A) Enable interactive logon for all service accounts
B) Move them to the Domain Admins group for better visibility
C) Rotate their passwords regularly and apply the principle of least privilege
D) Disable all service accounts immediately
