CND CND Endpoint Security & Hardening 1 — Questions and Answers
Question 1: What is the primary goal of OS hardening in a network defender's role?
- Increase system performance
- Reduce the attack surface by disabling unnecessary services and features (Correct answer)
- Enable remote desktop on all workstations
- Install the latest productivity software
Correct answer: Reduce the attack surface by disabling unnecessary services and features
OS hardening removes or disables unused services, accounts, and features, reducing the number of potential vulnerabilities an attacker can exploit.
Question 2: Which security benchmark is widely used as a baseline for endpoint hardening configurations?
- OWASP Top 10
- CIS Benchmarks (Correct answer)
- MITRE ATT&CK
- CVE Dictionary
Correct answer: CIS Benchmarks
CIS (Center for Internet Security) Benchmarks provide prescriptive, consensus-based hardening guidelines for operating systems, applications, and network devices.
Question 3: What is the purpose of application whitelisting on endpoints?
- Allow any application to run if it has a valid digital signature
- Permit only pre-approved applications to execute, blocking all others (Correct answer)
- Scan applications for viruses before launch
- Automatically update all installed applications
Correct answer: Permit only pre-approved applications to execute, blocking all others
Application whitelisting enforces a default-deny policy, allowing only explicitly approved programs to run and blocking all unknown or unauthorized executables.
Question 4: Which Windows feature uses virtualization to protect the integrity of the OS kernel from rootkits?
- BitLocker
- Credential Guard
- Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI) (Correct answer)
- Windows Defender Firewall
Correct answer: Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI)
VBS with HVCI uses hardware virtualization to isolate kernel code integrity checks in a protected environment, preventing kernel-level rootkits from tampering with the OS.
Question 5: What does EDR (Endpoint Detection and Response) provide beyond traditional antivirus?
- Only signature-based malware scanning
- Continuous behavioral monitoring, threat hunting, and incident response capabilities (Correct answer)
- Firewall rule management
- Patch deployment across endpoints
Correct answer: Continuous behavioral monitoring, threat hunting, and incident response capabilities
EDR solutions monitor endpoint behavior continuously, detect anomalies indicative of advanced threats, and provide tools for investigation and remediation.
Question 6: What is the security purpose of disabling USB ports on corporate endpoints?
- Improve system boot speed
- Prevent data exfiltration and introduction of malware via removable media (Correct answer)
- Reduce power consumption
- Improve keyboard and mouse performance
Correct answer: Prevent data exfiltration and introduction of malware via removable media
Disabling or controlling USB ports prevents attackers or insiders from copying sensitive data to thumb drives or introducing malware-infected media.
CND CND Endpoint Security & Hardening 1
What is the primary goal of OS hardening in a network defender's role?