CCD Endpoint Protection & Hardening 2

Question 1

Which Windows feature restricts applications from running in specific memory regions to prevent code injection attacks?

Accepted Answer

Data Execution Prevention (DEP)

Answer

DEP marks memory regions as non-executable, preventing attackers from running malicious code injected into data areas.

Question 2

An analyst finds that a workstation's local Administrator account is enabled and uses the same password across all endpoints. What is the primary risk?

Accepted Answer

Pass-the-hash lateral movement

Answer

Shared local admin passwords allow attackers to use credential hashes captured on one machine to authenticate laterally across all endpoints.

Question 3

Which hardening technique involves removing or disabling OS features, roles, and services not required for a system's function?

Accepted Answer

Attack surface reduction

Answer

Attack surface reduction minimizes exploitable components by removing unnecessary services, features, and software from endpoints.

Question 4

A security team wants to prevent users from installing unauthorized USB devices. Which control best addresses this?

Accepted Answer

Device control policy via endpoint security software

Answer

Device control policies in endpoint security platforms can whitelist approved devices and block unauthorized USB storage connections.

Question 5

What is the purpose of Microsoft's Local Administrator Password Solution (LAPS)?

Accepted Answer

Randomize and manage unique local admin passwords per endpoint

Answer

LAPS automatically sets and rotates unique local Administrator passwords per machine, stored securely in Active Directory.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Endpoint Protection & Hardening 2