CND Endpoint Security & Hardening Flashcards

What is the purpose of a security baseline configuration for endpoints?

Answer: Establish a minimum secure configuration standard all endpoints must meet

A security baseline defines the minimum required security settings—such as password policies, enabled services, and audit logging—that every endpoint in the organization must comply with.

Which of the following best describes 'fileless malware' and why it is challenging to detect?

Answer: Malicious code that executes entirely in memory without writing files to disk, evading file-based AV

Fileless malware runs entirely in memory (often via scripting engines like PowerShell), leaving no files on disk and evading traditional signature-based antivirus detection.

What does 'attack surface reduction' mean in the context of endpoint hardening?

Answer: Minimizing the number of exploitable entry points by disabling unnecessary features and services

Attack surface reduction involves disabling unneeded software, services, ports, and protocols to limit the ways an attacker can gain access to or persist on an endpoint.

Why is multi-factor authentication (MFA) important for protecting endpoint access?

Answer: It ensures an attacker with stolen credentials alone cannot log in

MFA requires a second factor beyond a password, so even if credentials are phished or stolen, the attacker cannot authenticate without the additional factor.

What is the purpose of Windows Defender Credential Guard?

Answer: Isolate and protect NTLM/Kerberos credential hashes in a virtualized container from theft

Credential Guard uses VBS to store NTLM and Kerberos credential material in an isolated hypervisor-protected environment, preventing Pass-the-Hash and Pass-the-Ticket attacks.

Which CND control specifically addresses preventing unauthorized software execution on endpoints through policy-based restrictions?

Answer: Software Restriction Policies (SRP) or AppLocker

Windows Software Restriction Policies and AppLocker enforce rules that allow or deny execution of applications based on path, publisher certificate, or file hash.