CND Endpoint Security & Hardening Flashcards

What is 'patch management' and why is it critical for endpoint security?

Answer: Regularly applying security updates to fix known vulnerabilities before attackers exploit them

Patch management ensures that known software vulnerabilities are remediated promptly, closing the window of exploitation before attackers can leverage public exploit code.

Which principle should guide the assignment of software privileges on an endpoint?

Answer: Principle of Least Privilege — grant only the minimum access required

The Principle of Least Privilege limits each user and process to only the permissions necessary for their function, minimizing damage if an account is compromised.

What is the function of a Host-Based Intrusion Prevention System (HIPS)?

Answer: Monitor and block suspicious activities on an individual endpoint in real time

HIPS monitors system calls, file access, registry changes, and network connections on the host, blocking actions that match malicious behavior patterns.

What security benefit does enabling full-disk encryption (e.g., BitLocker) provide for endpoints?

Answer: Protects data confidentiality if a device is lost or stolen

Full-disk encryption renders stored data unreadable without the correct decryption key, protecting sensitive information if a laptop or drive is physically stolen.

Which technique do attackers use to bypass application whitelisting by abusing trusted, pre-approved system tools?

Answer: Living off the Land (LotL) attacks using LOLBins

Living off the Land attacks abuse legitimate, pre-approved system binaries (LOLBins) like PowerShell, certutil, or mshta to execute malicious code within whitelisting policies.

What is the security role of a Trusted Platform Module (TPM) in endpoint security?

Answer: Provide a hardware-based secure enclave for storing cryptographic keys and verifying platform integrity

A TPM is a dedicated hardware chip that securely stores cryptographic keys and measurements of the boot process, enabling platform integrity verification and protecting secrets from software attacks.