CCD Endpoint Protection & Hardening 3 — Questions and Answers
Question 1: Which CIS Benchmark control recommends configuring time-based screen lock and requiring authentication to resume?
- Inactivity timeout and screen lock policy (Correct answer)
- Full disk encryption enforcement
- Endpoint detection and response deployment
- Application allowlisting
Correct answer: Inactivity timeout and screen lock policy
Inactivity screen lock policies prevent unauthorized access to unattended workstations, a key physical and logical security control.
Question 2: A threat actor exploits a macro in a Word document to download and execute a payload. Which control would MOST effectively prevent execution?
- Disabling macros from internet-originated documents via Group Policy (Correct answer)
- Enabling real-time antivirus scanning only
- Blocking all Office file email attachments
- Enabling Windows Firewall inbound rules
Correct answer: Disabling macros from internet-originated documents via Group Policy
Group Policy can enforce that macros in documents from the internet are disabled by default, preventing macro-based malware execution.
Question 3: What is the key difference between application whitelisting and blacklisting for endpoint protection?
- Whitelisting allows only approved applications; blacklisting blocks known malicious ones (Correct answer)
- Whitelisting blocks all traffic; blacklisting allows approved traffic
- Whitelisting is network-based; blacklisting is host-based
- Whitelisting requires agent deployment; blacklisting does not
Correct answer: Whitelisting allows only approved applications; blacklisting blocks known malicious ones
Whitelisting enforces a default-deny posture where only explicitly approved applications can run, while blacklisting only blocks known bad software.
Question 4: Which Windows security feature uses hardware-based isolation to protect the LSASS process from credential theft?
- Credential Guard (Correct answer)
- Secure Boot
- Windows Hello for Business
- Controlled Folder Access
Correct answer: Credential Guard
Credential Guard uses virtualization-based security (VBS) to isolate LSASS secrets, preventing tools like Mimikatz from extracting credentials.
Question 5: An EDR alert shows a legitimate signed binary (e.g., mshta.exe) spawning a PowerShell process that contacts an external IP. This behavior BEST represents which technique?
- Living-off-the-land (LotL) attack (Correct answer)
- Fileless persistence via registry
- DLL sideloading
- Pass-the-ticket attack
Correct answer: Living-off-the-land (LotL) attack
Living-off-the-land attacks abuse legitimate, trusted OS binaries (LOLBins) to execute malicious commands and evade detection.
Question 6: Which hardening measure prevents a compromised low-privilege process from writing to protected system directories on Windows?
- Mandatory Integrity Control (MIC) with integrity levels (Correct answer)
- Windows Defender real-time protection
- AppLocker publisher rules
- Audit object access policy
Correct answer: Mandatory Integrity Control (MIC) with integrity levels
MIC assigns integrity levels to processes and objects; low-integrity processes cannot write to medium- or high-integrity protected locations.
Question 7: A security engineer wants to detect when a process opens a handle to LSASS memory. Which Sysmon event ID captures this activity?
- Event ID 10 (ProcessAccess) (Correct answer)
- Event ID 1 (ProcessCreate)
- Event ID 3 (NetworkConnect)
- Event ID 13 (RegistryValueSet)
Correct answer: Event ID 10 (ProcessAccess)
Sysmon Event ID 10 logs when a process opens a handle to another process, which is a key indicator of credential dumping attempts targeting LSASS.
CCD Endpoint Protection & Hardening 3
Which CIS Benchmark control recommends configuring time-based screen lock and requiring authentication to resume?