CND Endpoint Protection Practice Test 2 — 15 Questions

Question 1

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network protection and Wi-Fi security inspection. Network protection and Wi-Fi security inspection is the MTD capability that detects rogue access points, evil twins, and man-in-the-middle attacks by monitoring the device's network connections and analyzing Wi-Fi traffic for anomalies. This directly addresses the requirement to detect network-layer threats such as rogue APs and MitM attacks.

Answer

Application sideloading enforcement

Answer

Containerized workspace isolation

Answer

Remote wipe capability for lost devices

Question 2

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

Accepted Answer

Configure 'Prevent installation of devices using drivers that match these device setup classes' for USB storage class. Group Policy's 'Prevent installation of devices using drivers that match these device setup classes' setting lets administrators block entire device setup classes (like USB mass storage, GUID {53f56307-b6bf-11d0-94f2-00a0c91efb8b}) while allowing other USB classes such as smart cards and HID input devices. This is the precise, class-based approach required by the policy.

Answer

Stop and disable the Windows Plug and Play service

Answer

Enable BitLocker To Go on all internal drives

Answer

Disable the USB Enhanced Host Controller Interface (EHCI) in BIOS across all endpoints

Question 3

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

Accepted Answer

/etc/profile. /etc/profile is a system-wide shell initialization script sourced by login shells for all users, making it the correct place to set a default umask that applies globally. Setting 'umask 027' or 'umask 077' here ensures every new file created by users inherits restrictive permissions. This is the standard Linux hardening practice for fleet-wide permission defaults.

Answer

/etc/ssh/sshd_config

Answer

/etc/security/limits.conf

Answer

/etc/environment

Question 4

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

Accepted Answer

Boot into Safe Mode and adjust the EDR driver start type or use sensor configuration exclusions. Booting into Safe Mode loads only essential drivers, preventing the EDR kernel-mode driver from starting and allowing administrative access to the system. Once in Safe Mode, the administrator can change the EDR driver's start type (e.g., from boot-start to demand-start) or apply sensor configuration exclusions to prevent the conflict with the third-party disk encryption filter driver. This isolates the conflicting driver without removing critical security controls or data protection.

Answer

Uninstall the third-party disk encryption driver permanently

Answer

Reinstall the Windows operating system with a clean image

Answer

Disable Secure Boot in UEFI settings

Question 5

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

Accepted Answer

unhide. unhide is a forensic utility specifically designed to detect hidden processes and TCP/UDP ports by cross-referencing multiple data sources, including the kernel system call table (via /proc and syscall hooks) against direct kernel memory reads. User-space rootkits commonly hook syscalls like getdents or read on /proc to filter out malicious PIDs from tools like ps, so a tool that bypasses those hooks is required. unhide's 'checkbrute' and 'checkall' modes compare /proc listings, /bin/ps output, and kernel memory to expose discrepancies.

Answer

lsof -i

Answer

netstat -anp

Answer

ps aux --forest

Question 6

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

Accepted Answer

Integrate third-party software patch catalogs into MECM or a dedicated Patch Management tool. Third-party applications (browsers, PDF readers, Java, etc.) are not covered by Microsoft's native update channels, so the scalable solution is to integrate third-party patch catalogs (e.g., Patch My PC, Ivanti, or vendor catalogs) into MECM or a dedicated patch management platform. This automates detection, download, and deployment of third-party updates alongside Microsoft patches.

Answer

Manually download and install MSI installers via local administrator logon scripts

Answer

Disable all third-party software on endpoints

Answer

Rely exclusively on Microsoft Windows Update for Business

Question 7

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

Accepted Answer

Object Access Auditing via Advanced Audit Policy Configuration. Windows Object Access Auditing, configured through Advanced Audit Policy Configuration (under Security Settings -> Advanced Audit Policy Configuration -> Object Access), lets administrators audit access to files and folders, including modifications. When combined with a System Access Control List (SACL) on critical files, any write, delete, or permission change generates a Security event (e.g., 4663) that can trigger alerts via SIEM or Windows Event Forwarding. This is the built-in mechanism for file integrity monitoring on Windows.

Answer

Disk Management (diskmgmt.msc)

Answer

Windows Server Backup

Answer

Task Scheduler

Question 8

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

Accepted Answer

Disabling installation from unknown sources and enforcing Managed Google Play accounts. To prevent users from installing apps from unknown sources and ensure corporate apps update automatically, the EMM/MDM policy should disable installation from unknown sources and enforce Managed Google Play accounts. This configuration restricts app installation to approved sources and allows automatic updates through Managed Google Play.

Answer

Configuring devices in personal use profile mode

Answer

Disabling factory reset protection (FRP)

Answer

Enabling USB debugging mode for all users

Question 9

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

Accepted Answer

Process Lineage and Tree Visualization. Process lineage and tree visualization reconstructs the parent-child relationships between processes (e.g., winword.exe → powershell.exe → cmd.exe), letting analysts see the full execution chain that led to a suspicious child process. This is a core EDR capability because it exposes attack patterns like Office macros spawning scripting engines — a hallmark of phishing and fileless malware. Without lineage, an isolated alert on the child process lacks the context needed to determine whether it is malicious.

Answer

Network Packet Capture (PCAP)

Answer

Hardware Diagnostics

Answer

Disk Defragmentation

Question 10

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

Accepted Answer

The Application Identity service (AppIDSvc) is stopped or disabled. AppLocker relies on the Application Identity service (AppIDSvc) to evaluate and enforce rules. If AppIDSvc is stopped or disabled, AppLocker policies are not applied, allowing all executables to run regardless of configured rules. The administrator's rule to allow signed apps would be ignored, and unsigned tools from user-writable directories would execute freely.

Answer

Windows Defender Real-time Protection is enabled

Answer

BitLocker encryption is not enabled on the system drive

Answer

Fast Startup is enabled in the BIOS

Question 11

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

Accepted Answer

Enforcing a passcode policy with complexity and auto-lock requirements. Data-at-rest protection on iOS/iPadOS is anchored in the Secure Enclave and the Data Protection API, which derives encryption keys from the device passcode. Without a strong passcode policy enforced via MDM (complexity, minimum length, auto-lock timeout), the encryption keys are trivially derivable and data at rest is effectively unprotected. MDM payloads such as com.apple.security.FDERecoveryKeyEscrow and Passcode Policy enforce these controls across supervised devices.

Answer

Disabling Apple Push Notification service (APNs)

Answer

Enabling AirDrop for all contacts

Answer

Enabling iCloud Backup for all application data

Question 12

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

Accepted Answer

Remote Host Isolation / Network Containment. Remote Host Isolation (network containment) is the EDR capability that severs an endpoint's network connectivity while leaving the machine powered on, preserving volatile memory (RAM) for forensic analysis. This matches the IR team's requirement to disconnect without shutting down, allowing memory capture of ransomware artifacts, encryption keys, and process state. It is the standard containment action in modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Answer

Disk Defragmentation

Answer

Remote Device Wipe

Answer

Cloud Sandbox Submission

Question 13

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The SUID bit is represented by the octal permission value 4000, so 'find / -perm -4000 -type f' locates all regular files with that bit set. The '-type f' restricts results to files (not directories), and '2>/dev/null' suppresses permission-denied errors from unreadable directories. This is the canonical command for auditing SUID binaries during Linux hardening.

Answer

find / -attr +s -type d

Answer

locate -i suid_binaries

Answer

chmod -R 755 /

Question 14

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

Accepted Answer

arp.exe or ipconfig.exe. arp.exe and ipconfig.exe are native, signed Windows utilities that attackers routinely abuse for network discovery — arp -a enumerates the local ARP cache to map hosts, and ipconfig /all reveals IP configuration, DNS servers, and adapters. Because they are legitimate Microsoft binaries, they often bypass application allowlisting and blend into normal admin activity, making them classic living-off-the-land binaries (LotLBs) that EDR behavioral rules must monitor.

Answer

calc.exe

Answer

mspaint.exe

Answer

notepad.exe

Question 15

An organization is implementing comprehensive endpoint hardening for Windows 10/11 endpoints. Which THREE of the following measures directly contribute to reducing the attack surface against memory-based exploits and credential theft? (Choose THREE)

Accepted Answer

Enabling Windows Defender Exploit Protection system settings (e.g., CFG, DEP, ASLR). Option A is correct because Windows Defender Exploit Protection enforces memory-corruption mitigations such as Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), which directly harden processes against memory-based exploits. Option C is correct because Credential Guard uses virtualization-based security (VBS) to isolate LSA secrets in a protected environment, preventing tools like Mimikatz from harvesting NTLM hashes and Kerberos tickets. Option D is correct because Attack Surface Reduction (ASR) rules block behaviors commonly used in exploit chains and credential theft, such as Office child-process creation, script-based execution, and credential dumping via lsass. Option B does not belong because disabling UPnP removes a network discovery/port-mapping convenience feature and does not mitigate memory exploits or credential theft. Option E does not belong because disabling SMBv1 addresses lateral movement and legacy protocol vulnerabilities (e.g., WannaCry) rather than memory-based exploitation or credential dumping on the endpoint itself.

Answer

Disabling Universal Plug and Play (UPnP) service on endpoints

Answer

Disabling the Server Message Block v1 (SMBv1) protocol