CND Endpoint Protection — 25 Questions

Question 1

An Incident Responder analyzing a compromised Linux server suspects a rootkit has modified system binaries. The responder runs the package manager verification command on Debian/Ubuntu to check installed packages against the package database. Which command is appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dpkg --verify. debsums verifies installed package files against MD5 checksums stored in package archives on Debian-based systems.

Answer

rpm -Va

Answer

debsums -ac

Answer

apt-get check-integrity

Question 2

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

Accepted Answer

Windows PowerShell Operational Log (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) logs the full content of code blocks as they are executed, capturing obfuscated or encoded scripts in their decoded form.

Answer

System Event Log (Event ID 7045)

Answer

Security Event Log (Event ID 4688)

Answer

Windows Defender Operational Log (Event ID 1116)

Question 3

A security engineer is configuring mobile device management (MDM) for corporate-owned iOS devices. To prevent users from installing unauthorized apps while still allowing access to enterprise applications, which feature should be deployed?

Accepted Answer

Volume Purchase Program (VPP) with Managed Distribution. Managed Apple ID combined with a restricted app list or configuring a curated App Store layout via MDM achieves controlled application deployment.

Answer

Apple Configurator tethered supervision only

Answer

Managed Open In restriction

Answer

Enterprise App Sideloading via Developer Profiles

Question 4

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

Accepted Answer

Windows Defender Credential Guard. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them, protecting against pass-the-hash.

Answer

Windows Defender Application Control (WDAC)

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 5

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

Accepted Answer

Maintenance Windows. Maintenance Windows allow administrators to define specific time frames when deployments, updates, and configurations can run without impacting user productivity.

Answer

Software Update Groups

Answer

Automatic Deployment Rules (ADR)

Answer

Client Settings - Computer Restart

Question 6

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

Accepted Answer

Local Security Policy (secpol.msc). Local Security Policy (secpol.msc) allows administrators to configure account policies, audit policies, and security options on standalone systems.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Group Policy Management Console (gpmc.msc)

Answer

System Configuration (msconfig.exe)

Question 7

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

Accepted Answer

aa-complain /usr/sbin/daemon. The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.

Answer

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Answer

systemctl set-mode apparmor=complain

Answer

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Question 8

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

Accepted Answer

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties -> Outbound connections. The default outbound behavior of Windows Defender Firewall needs to be changed from Allow to Block in the GPO profile settings under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security.

Answer

Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall

Answer

Computer Configuration -> Preferences -> Control Panel Settings -> Network Options

Answer

Computer Configuration -> Policies -> Software Restriction Policies

Question 9

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

Accepted Answer

/etc/modprobe.d/blacklist.conf. Kernel module blacklisting on modern Linux distributions is configured by creating configuration files inside the /etc/modprobe.d/ directory.

Answer

/etc/fstab

Answer

/boot/grub/grub.cfg

Answer

/etc/sysctl.conf

Question 10

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

Accepted Answer

clevis and systemd-cryptsetup. clevis is a client-side automated decryption framework that integrates with systemd-cryptsetup to unlock LUKS volumes using network policies or TPM2 bindings.

Answer

fdisk partition manager

Answer

gnupg keychain agent

Answer

cryptsetup-reencrypt

Question 11

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

Accepted Answer

Network protection and Wi-Fi security inspection. Advanced Mobile Threat Defense agents monitor network traffic anomalies, SSL stripping, and ARP spoofing to detect rogue access points and MitM attacks.

Answer

Application sideloading enforcement

Answer

Containerized workspace isolation

Answer

Remote wipe capability for lost devices

Question 12

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

Accepted Answer

Configure 'Prevent installation of devices using drivers that match these device setup classes' for USB storage class. Group Policy allows restricting removable storage access under Computer Configuration -> Administrative Templates -> System -> Device Installation -> Device Installation Restrictions.

Answer

Stop and disable the Windows Plug and Play service

Answer

Enable BitLocker To Go on all internal drives

Answer

Disable the USB Enhanced Host Controller Interface (EHCI) in BIOS across all endpoints

Question 13

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

Accepted Answer

/etc/profile. The system-wide default umask for login shells on many Linux distributions is configured in /etc/profile or /etc/login.defs.

Answer

/etc/ssh/sshd_config

Answer

/etc/security/limits.conf

Answer

/etc/environment

Question 14

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

Accepted Answer

Boot into Safe Mode and adjust the EDR driver start type or use sensor configuration exclusions. Booting into Safe Mode or using the EDR management console to temporarily disable specific sensor modules (such as kernel process or file monitoring) allows isolation of the conflicting component.

Answer

Uninstall the third-party disk encryption driver permanently

Answer

Reinstall the Windows operating system with a clean image

Answer

Disable Secure Boot in UEFI settings

Question 15

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

Accepted Answer

unhide. rkhunter or chkrootkit can check for hidden processes, but specialized tools like unhide directly compare ps/top outputs with direct procfs/syscall examination to detect hidden PIDs.

Answer

lsof -i

Answer

netstat -anp

Answer

ps aux --forest

Question 16

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

Accepted Answer

Integrate third-party software patch catalogs into MECM or a dedicated Patch Management tool. Modern endpoint management and EDR/patch tools integrate third-party catalog feeds to automatically package and push vendor patches to endpoints.

Answer

Manually download and install MSI installers via local administrator logon scripts

Answer

Disable all third-party software on endpoints

Answer

Rely exclusively on Microsoft Windows Update for Business

Question 17

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

Accepted Answer

Object Access Auditing via Advanced Audit Policy Configuration. File Server Resource Manager or Windows Defender Application Control / File Integrity Monitoring mechanisms can track changes. For general integrity auditing, Windows provides audit policies for file access.

Answer

Disk Management (diskmgmt.msc)

Answer

Windows Server Backup

Answer

Task Scheduler

Question 18

A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?

Accepted Answer

-w /etc/passwd -p wa -k identity. Monitoring sensitive files like /etc/passwd and /etc/shadow requires adding watch rules using the -w flag with write permissions (-p w).

Answer

-a always,exclude -F path=/etc/passwd

Answer

sysctl -w kernel.audit=1

Answer

-e 0

Question 19

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

Accepted Answer

Disabling installation from unknown sources and enforcing Managed Google Play accounts. Disabling 'Unknown Sources' (installations from outside Google Play) combined with forcing Google Play managed accounts ensures secure app management.

Answer

Configuring devices in personal use profile mode

Answer

Disabling factory reset protection (FRP)

Answer

Enabling USB debugging mode for all users

Question 20

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

Accepted Answer

Process Lineage and Tree Visualization. EDR tools capture process creation telemetry, allowing analysts to visualize process trees showing parent-child relationships and command-line arguments.

Answer

Network Packet Capture (PCAP)

Answer

Hardware Diagnostics

Answer

Disk Defragmentation