CND CND Endpoint Security & Hardening 2 — Questions and Answers
Question 1: What is 'patch management' and why is it critical for endpoint security?
- Installing new features to improve productivity
- Regularly applying security updates to fix known vulnerabilities before attackers exploit them (Correct answer)
- Replacing hardware components on schedule
- Backing up endpoint configurations
Correct answer: Regularly applying security updates to fix known vulnerabilities before attackers exploit them
Patch management ensures that known software vulnerabilities are remediated promptly, closing the window of exploitation before attackers can leverage public exploit code.
Question 2: Which principle should guide the assignment of software privileges on an endpoint?
- Give all users administrator rights for convenience
- Assign maximum privileges by default, then restrict as needed
- Principle of Least Privilege — grant only the minimum access required (Correct answer)
- Privileges should match those of the most senior user in a group
Correct answer: Principle of Least Privilege — grant only the minimum access required
The Principle of Least Privilege limits each user and process to only the permissions necessary for their function, minimizing damage if an account is compromised.
Question 3: What is the function of a Host-Based Intrusion Prevention System (HIPS)?
- Encrypt files on the host's hard drive
- Monitor and block suspicious activities on an individual endpoint in real time (Correct answer)
- Manage network firewall rules centrally
- Scan email attachments for malware
Correct answer: Monitor and block suspicious activities on an individual endpoint in real time
HIPS monitors system calls, file access, registry changes, and network connections on the host, blocking actions that match malicious behavior patterns.
Question 4: What security benefit does enabling full-disk encryption (e.g., BitLocker) provide for endpoints?
- Speeds up system boot time
- Protects data confidentiality if a device is lost or stolen (Correct answer)
- Prevents malware from running
- Enforces password complexity policies
Correct answer: Protects data confidentiality if a device is lost or stolen
Full-disk encryption renders stored data unreadable without the correct decryption key, protecting sensitive information if a laptop or drive is physically stolen.
Question 5: Which technique do attackers use to bypass application whitelisting by abusing trusted, pre-approved system tools?
- SQL injection
- Living off the Land (LotL) attacks using LOLBins (Correct answer)
- Cross-site scripting
- ARP spoofing
Correct answer: Living off the Land (LotL) attacks using LOLBins
Living off the Land attacks abuse legitimate, pre-approved system binaries (LOLBins) like PowerShell, certutil, or mshta to execute malicious code within whitelisting policies.
Question 6: What is the security role of a Trusted Platform Module (TPM) in endpoint security?
- Provide a hardware-based secure enclave for storing cryptographic keys and verifying platform integrity (Correct answer)
- Increase network throughput on the endpoint
- Manage user account passwords locally
- Perform antivirus scanning at the hardware level
Correct answer: Provide a hardware-based secure enclave for storing cryptographic keys and verifying platform integrity
A TPM is a dedicated hardware chip that securely stores cryptographic keys and measurements of the boot process, enabling platform integrity verification and protecting secrets from software attacks.
CND CND Endpoint Security & Hardening 2
What is 'patch management' and why is it critical for endpoint security?