CND Endpoint Protection Practice Test 1 — 15 Questions

Question 1

An Incident Responder analyzing a compromised Linux server suspects a rootkit has modified system binaries. The responder runs the package manager verification command on Debian/Ubuntu to check installed packages against the package database. Which command is appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dpkg --verify. On Debian/Ubuntu systems, dpkg is the low-level package manager and maintains a database of installed packages including MD5 checksums of every file. Running 'dpkg --verify' (or '-V') compares the current on-disk files against the recorded checksums and metadata, revealing binaries modified by a rootkit. This is the native Debian equivalent of RPM's verification capability.

Answer

rpm -Va

Answer

debsums -ac

Answer

apt-get check-integrity

Question 2

A security engineer is configuring mobile device management (MDM) for corporate-owned iOS devices. To prevent users from installing unauthorized apps while still allowing access to enterprise applications, which feature should be deployed?

Accepted Answer

Volume Purchase Program (VPP) with Managed Distribution. Volume Purchase Program (VPP) with Managed Distribution lets organizations purchase and assign apps to supervised devices via MDM without requiring an Apple ID, and combined with MDM restrictions it prevents users from installing unauthorized apps from the App Store. This satisfies both requirements: blocking unauthorized installs while still delivering approved enterprise applications. VPP Managed Distribution is the standard Apple mechanism for corporate app deployment on supervised iOS devices.

Answer

Apple Configurator tethered supervision only

Answer

Managed Open In restriction

Answer

Enterprise App Sideloading via Developer Profiles

Question 3

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

Accepted Answer

aa-complain /usr/sbin/daemon. The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.

Answer

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Answer

systemctl set-mode apparmor=complain

Answer

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Question 4

A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?

Accepted Answer

-w /etc/passwd -p wa -k identity. Monitoring sensitive files like /etc/passwd and /etc/shadow requires adding watch rules using the -w flag with write permissions (-p w).

Answer

-a always,exclude -F path=/etc/passwd

Answer

sysctl -w kernel.audit=1

Answer

-e 0

Question 5

An administrator needs to harden an IoT gateway running Linux by disabling core dumps globally to prevent sensitive application memory from being written to disk if a process crashes. Which configuration should be applied?

Accepted Answer

Setting ProcessCoreDump=false in /etc/systemd/coredump.conf. Core dumps are disabled globally by configuring limits in /etc/security/limits.conf or via systemd's coredump.conf.

Answer

Running chmod 000 /bin/sh

Answer

Editing /etc/fstab to mount /tmp as read-only

Answer

Modifying /etc/resolv.conf to block DNS queries

Question 6

An enterprise Incident Response team is investigating a compromised endpoint using EDR telemetry and live response tools. Which THREE of the following actions can typically be performed directly from an enterprise EDR console during active triage? (Choose THREE)

Accepted Answer

Isolating the endpoint from the network while maintaining agent management connectivity. Option C is correct because enterprise EDR consoles commonly provide a network-isolation or "contain host" action that blocks most inbound/outbound traffic via the agent's filter driver while preserving the management channel to the EDR cloud so the analyst can keep issuing commands. Option D is correct because EDR live-response capabilities can capture volatile evidence such as RAM images, process memory dumps, and running-process metadata directly through the agent for forensic analysis. Option E is correct because EDR platforms allow responders to kill or terminate malicious processes and quarantine or delete identified executable files from the console in real time. Option A is incorrect because reflashing UEFI/BIOS firmware requires vendor-specific flashing utilities and physical or out-of-band access, not an EDR console action. Option B is incorrect because rebuilding a hardware RAID controller's striping configuration is a firmware/controller-level operation performed through the RAID BIOS or vendor management tool, not through EDR telemetry or live-response tooling.

Answer

Reflashing the physical UEFI/BIOS firmware of the endpoint motherboard

Answer

Rebuilding the hardware RAID controller striping configuration

Question 7

A security administrator is implementing application whitelisting on a set of Windows 10 endpoints to prevent unauthorized executables from running. The administrator wants to use a built-in Windows feature that allows granular control based on file path, publisher, or file hash. Which TWO of the following Windows features can be used to achieve this goal? (Choose two.)

Accepted Answer

Windows Defender Application Control (WDAC). AppLocker and Windows Defender Application Control (WDAC) are built-in Windows features designed for application whitelisting. AppLocker provides rule-based control via Group Policy, while WDAC enforces code integrity at the kernel level. Both allow granular rules based on path, publisher, or hash. Software Restriction Policies is legacy, and Windows Firewall and UAC do not provide application execution control.

Answer

Windows Firewall with Advanced Security

Answer

User Account Control (UAC)

Answer

Software Restriction Policies (SRP)

Question 8

A security analyst is investigating a malware incident on a Windows 10 endpoint. The analyst suspects that the malware established persistence by modifying the registry. Which of the following registry locations is commonly used by malware to automatically execute on system startup?

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion is a well-known autostart location that malware frequently abuses for persistence. Modifications here cause programs to execute at system startup or user logon. Other keys like Shell Folders, Services, and exefile command are less common or serve different purposes, making the Run key the most likely location for simple malware persistence.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Answer

HKEY_CLASSES_ROOT\exefile\shell\open\command

Question 9

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

Accepted Answer

Windows PowerShell Operational Log (Event ID 4104). The Windows PowerShell Operational Log records script block logging events, specifically Event ID 4104, which captures the decoded contents of script blocks executed by PowerShell. When an encoded command is run, PowerShell decodes it internally, and if script block logging is enabled, the decoded script is written to this log. This makes Event ID 4104 the correct source for retrieving the actual script contents, not just the encoded command line.

Answer

System Event Log (Event ID 7045)

Answer

Security Event Log (Event ID 4688)

Answer

Windows Defender Operational Log (Event ID 1116)

Question 10

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

Accepted Answer

Windows Defender Credential Guard. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate LSASS and its derived credentials in a separate, hypervisor-protected container. This prevents tools like Mimikatz from reading NTLM hashes or Kerberos tickets out of LSASS memory, directly mitigating pass-the-hash. It requires UEFI Secure Boot, virtualization extensions, and is enabled via Group Policy or Intune.

Answer

Windows Defender Application Control (WDAC)

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 11

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

Accepted Answer

Maintenance Windows. Maintenance Windows in MECM define a scheduled time range during which deployments (including software updates) are permitted to install and, critically, when restarts may occur. Configuring a maintenance window outside active hours ensures patches install and reboots happen without disrupting users. This is the MECM feature purpose-built for controlling when updates apply on a schedule.

Answer

Software Update Groups

Answer

Automatic Deployment Rules (ADR)

Answer

Client Settings - Computer Restart

Question 12

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

Accepted Answer

Local Security Policy (secpol.msc). Local Security Policy (secpol.msc) is the Microsoft Management Console snap-in that exposes Account Policies — including Password Policy (complexity, minimum length, history) and Account Lockout Policy — for standalone Windows systems not governed by domain Group Policy. It writes to the local security database and is the correct tool for non-domain-joined endpoints.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Group Policy Management Console (gpmc.msc)

Answer

System Configuration (msconfig.exe)

Question 13

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

Accepted Answer

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties -> Outbound connections. In Windows Defender Firewall with Advanced Security, the default outbound action (Allow or Block) is configured per profile under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties, then selecting each profile (Domain, Private, Public) and setting the Outbound connections radio button to Block. This is the only location in GPO where the firewall's default outbound behaviour is defined; individual rules then explicitly permit traffic.

Answer

Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall

Answer

Computer Configuration -> Preferences -> Control Panel Settings -> Network Options

Answer

Computer Configuration -> Policies -> Software Restriction Policies

Question 14

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

Accepted Answer

/etc/modprobe.d/blacklist.conf. Kernel module blacklisting on Linux is configured in files under /etc/modprobe.d/, conventionally /etc/modprobe.d/blacklist.conf, using the 'blacklist <module>' directive. This prevents the module from being auto-loaded by udev or other mechanisms during boot or hotplug events. For a minimal IoT kernel, this is the standard way to disable USB storage (usb-storage) and Bluetooth (bluetooth, btusb) modules.

Answer

/etc/fstab

Answer

/boot/grub/grub.cfg

Answer

/etc/sysctl.conf

Question 15

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

Accepted Answer

clevis and systemd-cryptsetup. Clevis and systemd-cryptsetup are used together to enable automatic decryption of LUKS-encrypted volumes using a TPM 2.0 chip. Clevis provides a framework for automated decryption, and systemd-cryptsetup integrates with systemd to unlock the volume during boot without manual passphrase entry.

Answer

fdisk partition manager

Answer

gnupg keychain agent

Answer

cryptsetup-reencrypt