CCD Endpoint Protection & Hardening 2 — Questions and Answers
Question 1: Which Windows feature restricts applications from running in specific memory regions to prevent code injection attacks?
- Data Execution Prevention (DEP) (Correct answer)
- Windows Firewall
- BitLocker Drive Encryption
- User Account Control (UAC)
Correct answer: Data Execution Prevention (DEP)
DEP marks memory regions as non-executable, preventing attackers from running malicious code injected into data areas.
Question 2: An analyst finds that a workstation's local Administrator account is enabled and uses the same password across all endpoints. What is the primary risk?
- Pass-the-hash lateral movement (Correct answer)
- Brute force dictionary attacks
- Privilege escalation via sudo
- DNS poisoning attacks
Correct answer: Pass-the-hash lateral movement
Shared local admin passwords allow attackers to use credential hashes captured on one machine to authenticate laterally across all endpoints.
Question 3: Which hardening technique involves removing or disabling OS features, roles, and services not required for a system's function?
- Attack surface reduction (Correct answer)
- Patch management
- Log aggregation
- Network segmentation
Correct answer: Attack surface reduction
Attack surface reduction minimizes exploitable components by removing unnecessary services, features, and software from endpoints.
Question 4: A security team wants to prevent users from installing unauthorized USB devices. Which control best addresses this?
- Device control policy via endpoint security software (Correct answer)
- Disabling AutoPlay only
- Enabling Windows Defender Firewall
- Applying AppLocker to network shares
Correct answer: Device control policy via endpoint security software
Device control policies in endpoint security platforms can whitelist approved devices and block unauthorized USB storage connections.
Question 5: What is the purpose of Microsoft's Local Administrator Password Solution (LAPS)?
- Randomize and manage unique local admin passwords per endpoint (Correct answer)
- Enforce password complexity for domain accounts
- Enable multi-factor authentication on workstations
- Encrypt local SAM database entries
Correct answer: Randomize and manage unique local admin passwords per endpoint
LAPS automatically sets and rotates unique local Administrator passwords per machine, stored securely in Active Directory.
Question 6: Which endpoint log source is most valuable for detecting process injection attacks on Windows?
- Sysmon Event ID 8 (CreateRemoteThread) (Correct answer)
- Windows Security Event ID 4624 (Logon)
- Application Event Log errors
- DNS client cache logs
Correct answer: Sysmon Event ID 8 (CreateRemoteThread)
Sysmon Event ID 8 captures CreateRemoteThread calls, a primary technique used in process injection attacks.
Question 7: An organization deploys a host-based IPS (HIPS) on all endpoints. Which attack type does this MOST directly help prevent?
- Exploitation of known vulnerabilities at the endpoint level (Correct answer)
- Phishing emails reaching the inbox
- Man-in-the-middle attacks on the network
- DNS hijacking at the resolver
Correct answer: Exploitation of known vulnerabilities at the endpoint level
HIPS monitors system calls and behaviors on the endpoint itself, blocking exploitation attempts targeting local vulnerabilities in real time.
CCD Endpoint Protection & Hardening 2
Which Windows feature restricts applications from running in specific memory regions to prevent code injection attacks?