CCD Endpoint Protection & Hardening 3

Question 1

Which CIS Benchmark control recommends configuring time-based screen lock and requiring authentication to resume?

Accepted Answer

Inactivity timeout and screen lock policy

Answer

Inactivity screen lock policies prevent unauthorized access to unattended workstations, a key physical and logical security control.

Question 2

A threat actor exploits a macro in a Word document to download and execute a payload. Which control would MOST effectively prevent execution?

Accepted Answer

Disabling macros from internet-originated documents via Group Policy

Answer

Group Policy can enforce that macros in documents from the internet are disabled by default, preventing macro-based malware execution.

Question 3

What is the key difference between application whitelisting and blacklisting for endpoint protection?

Accepted Answer

Whitelisting allows only approved applications; blacklisting blocks known malicious ones

Answer

Whitelisting enforces a default-deny posture where only explicitly approved applications can run, while blacklisting only blocks known bad software.

Question 4

Which Windows security feature uses hardware-based isolation to protect the LSASS process from credential theft?

Accepted Answer

Credential Guard

Answer

Credential Guard uses virtualization-based security (VBS) to isolate LSASS secrets, preventing tools like Mimikatz from extracting credentials.

Question 5

An EDR alert shows a legitimate signed binary (e.g., mshta.exe) spawning a PowerShell process that contacts an external IP. This behavior BEST represents which technique?

Accepted Answer

Living-off-the-land (LotL) attack

Answer

Living-off-the-land attacks abuse legitimate, trusted OS binaries (LOLBins) to execute malicious commands and evade detection.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Endpoint Protection & Hardening 3