CND Endpoint Security & Hardening Flashcards

What is the primary goal of OS hardening in a network defender's role?

Answer: Reduce the attack surface by disabling unnecessary services and features

OS hardening removes or disables unused services, accounts, and features, reducing the number of potential vulnerabilities an attacker can exploit.

Which security benchmark is widely used as a baseline for endpoint hardening configurations?

Answer: CIS Benchmarks

CIS (Center for Internet Security) Benchmarks provide prescriptive, consensus-based hardening guidelines for operating systems, applications, and network devices.

What is the purpose of application whitelisting on endpoints?

Answer: Permit only pre-approved applications to execute, blocking all others

Application whitelisting enforces a default-deny policy, allowing only explicitly approved programs to run and blocking all unknown or unauthorized executables.

Which Windows feature uses virtualization to protect the integrity of the OS kernel from rootkits?

Answer: Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI)

VBS with HVCI uses hardware virtualization to isolate kernel code integrity checks in a protected environment, preventing kernel-level rootkits from tampering with the OS.

What does EDR (Endpoint Detection and Response) provide beyond traditional antivirus?

Answer: Continuous behavioral monitoring, threat hunting, and incident response capabilities

EDR solutions monitor endpoint behavior continuously, detect anomalies indicative of advanced threats, and provide tools for investigation and remediation.

What is the security purpose of disabling USB ports on corporate endpoints?

Answer: Prevent data exfiltration and introduction of malware via removable media

Disabling or controlling USB ports prevents attackers or insiders from copying sensitive data to thumb drives or introducing malware-infected media.