CND CND Endpoint Security & Hardening 2

Question 1

What is 'patch management' and why is it critical for endpoint security?

Accepted Answer

Regularly applying security updates to fix known vulnerabilities before attackers exploit them

Answer

Patch management ensures that known software vulnerabilities are remediated promptly, closing the window of exploitation before attackers can leverage public exploit code.

Question 2

Which principle should guide the assignment of software privileges on an endpoint?

Accepted Answer

Principle of Least Privilege — grant only the minimum access required

Answer

The Principle of Least Privilege limits each user and process to only the permissions necessary for their function, minimizing damage if an account is compromised.

Question 3

What is the function of a Host-Based Intrusion Prevention System (HIPS)?

Accepted Answer

Monitor and block suspicious activities on an individual endpoint in real time

Answer

HIPS monitors system calls, file access, registry changes, and network connections on the host, blocking actions that match malicious behavior patterns.

Question 4

What security benefit does enabling full-disk encryption (e.g., BitLocker) provide for endpoints?

Accepted Answer

Protects data confidentiality if a device is lost or stolen

Answer

Full-disk encryption renders stored data unreadable without the correct decryption key, protecting sensitive information if a laptop or drive is physically stolen.

Question 5

Which technique do attackers use to bypass application whitelisting by abusing trusted, pre-approved system tools?

Accepted Answer

Living off the Land (LotL) attacks using LOLBins

Answer

Living off the Land attacks abuse legitimate, pre-approved system binaries (LOLBins) like PowerShell, certutil, or mshta to execute malicious code within whitelisting policies.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND CND Endpoint Security & Hardening 2