GSEC Endpoint Security — 10 Questions

Question 1

An administrator observes unauthorized lateral movement via PowerShell Remoting on a Windows network. Which security control best mitigates this risk by restricting administrative access to specific jump hosts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a WinRM listener to accept connections only from a specific jump host IP.. Restricting WinRM access to specific source IP addresses ensures that only authorized jump servers can initiate remote management sessions. This technique, known as tiered administration, limits the blast radius of compromised credentials. By enforcing network-level filtering on the endpoint, administrators prevent attackers from leveraging PowerShell Remoting from arbitrary internal workstations, directly countering credential-based lateral movement tactics prevalent in modern enterprise environments.

Answer

Disable the Windows Remote Management (WinRM) service globally.

Answer

Enable Windows Defender Credential Guard to isolate LSASS.

Answer

Implement AppLocker in 'Audit Only' mode to track PowerShell usage.

Question 2

An organization is deploying an Endpoint Detection and Response (EDR) solution. Which TWO of the following capabilities are primarily focused on post-compromise detection and investigation?

Accepted Answer

Continuous recording of process creation and command-line arguments.. EDR tools focus on behavioral analysis and forensic telemetry to identify threats that bypass traditional signature-based antivirus. By recording process execution, file modifications, and network connections, security teams can reconstruct the sequence of an attack. These capabilities are critical for incident response, allowing teams to determine the root cause, identify the scope of the infection, and perform precise remediation on affected endpoints without needing to reimage every device.

Answer

File-based signature matching against a global cloud database.

Answer

Real-time blocking of known malicious websites via DNS filtering.

Answer

Enforcement of disk encryption policies via MDM integration.

Question 3

Which configuration best protects an endpoint against 'Pass-the-Hash' (PtH) attacks involving local administrator accounts?

Accepted Answer

Disabling NTLM authentication and using Kerberos where possible.. Pass-the-Hash attacks involve an attacker using an NTLM hash or Kerberos ticket to authenticate as a user without needing their password. By restricting the usage of local administrator accounts to specific workstations via Group Policy, the scope of these credentials is minimized. Combined with credential hardening, this makes it significantly harder for an attacker to move laterally using stolen hashes from memory.

Answer

Enforcing complex passwords for local administrator accounts.

Answer

Increasing the frequency of password rotation for all users.

Answer

Installing an antivirus agent on all workstations.

Question 4

A security analyst is investigating a Windows 10 workstation that has been compromised by a fileless malware attack. The malware executed entirely in memory and left no files on disk, but the analyst suspects the malicious code was injected into a legitimate process. Which native Windows feature should the analyst examine to identify the injected code and its origin?

Accepted Answer

Windows Event Tracing for Windows (ETW) with the Microsoft-Windows-Threat-Intelligence provider. Event Tracing for Windows (ETW) with the Threat-Intelligence provider offers deep visibility into kernel and user-mode activities, including process injection and memory manipulation, which are hallmarks of fileless malware. Unlike traditional event logs or performance tools, ETW can trace the exact moment and source of code injection, enabling analysts to reconstruct the attack chain and identify the malicious process.

Answer

Windows Defender Application Control (WDAC) logs

Answer

Windows Event Logs, specifically Security event ID 4688 (Process Creation)

Answer

Windows Performance Recorder (WPR) with the CPU usage profile

Question 5

A financial institution is hardening its Linux servers against privilege escalation attacks. The security team wants to enforce that only binaries with a valid digital signature from approved vendors can execute with elevated privileges, while allowing unsigned binaries to run with normal user permissions. Which Linux kernel feature should the team implement to achieve this granular control?

Accepted Answer

Linux Integrity Measurement Architecture (IMA) with appraisal and digital signatures. Linux Integrity Measurement Architecture (IMA) with appraisal and digital signatures enables the kernel to verify the cryptographic signature of an executable before it runs. This allows a policy where only binaries signed by trusted keys can execute with elevated privileges, while unsigned binaries may still run with standard user rights. This granular control is exactly what the financial institution needs to prevent privilege escalation via tampered or malicious binaries.

Answer

seccomp filters with a whitelist of allowed system calls

Answer

SELinux in enforcing mode with a strict policy

Answer

AppArmor with profile-based confinement

Question 6

A security analyst is investigating a compromised Linux server. The attacker gained initial access via a web application vulnerability and then escalated privileges to root. The analyst needs to determine what persistence mechanisms were installed. Which of the following locations should the analyst examine FIRST to identify a malicious cron job that runs every minute?

Accepted Answer

/var/spool/cron/crontabs/root. On Debian-based Linux systems, user-specific cron jobs are stored in /var/spool/cron/crontabs/. The root user's crontab is at /var/spool/cron/crontabs/root, making it the primary location for a malicious per-minute job added by an attacker with root access. Other locations like /etc/crontab and /etc/cron.d/ are system-wide and less likely for stealthy persistence. /etc/cron.hourly/ only runs hourly, not per minute.

Answer

/etc/crontab

Answer

/etc/cron.d/

Answer

/etc/cron.hourly/

Question 7

A security analyst is hardening a fleet of Windows 10 workstations that must run only approved business applications. The analyst wants to block all unapproved executables and scripts, including those launched by users with local administrator rights, while minimizing disruption to signed Microsoft and third-party applications. Which Windows feature should the analyst implement?

Accepted Answer

AppLocker with default rules and a publisher rule for approved vendors. AppLocker is the appropriate Windows feature because it enforces application control through publisher, path, and hash rules, and its policies apply to administrators as well as standard users. Using default rules plus publisher rules for approved vendors blocks unapproved executables and scripts while allowing signed business applications to run, matching the requirement to harden endpoints without breaking approved software.

Answer

Windows Defender Firewall with outbound rules blocking unknown applications

Answer

Windows Defender Application Control (WDAC) in audit mode

Answer

Software Restriction Policies (SRP) with a disallowed-by-default rule

Question 8

Refer to the exhibit. An administrator applies this policy to a Windows workstation. What is the expected behavior for a user attempting to execute a legitimate application installed in their AppData folder?

Accepted Answer

The application will be blocked from execution.. The policy explicitly defines a 'Deny' rule for the AppData directory. Since the policy mode is set to 'Enforce', the endpoint security engine will block any executable residing in that path. This is a common security practice to prevent the execution of malicious payloads frequently dropped into temporary user directories, though it may inadvertently block legitimate software that installs to the user profile instead of Program Files.

Answer

The application will run normally because AppData is a standard location.

Answer

The application will run, but the activity will be logged for review.

Answer

The system will automatically move the application to Program Files.

Question 9

Which endpoint hardening technique is most effective at preventing unauthorized code execution by restricting the environment to only pre-approved software?

Accepted Answer

Implementing an application allowlisting solution.. Allowlisting, or application control, is the most robust method for preventing unknown or unauthorized code execution. By only allowing known, trusted binaries to run, it mitigates the risk of malware, even zero-day exploits, since the malicious code will not be on the approved list. This is a foundational strategy for high-security environments where the risk of execution must be strictly minimized.

Answer

Disabling local administrator accounts for standard users.

Answer

Enabling real-time scanning in antivirus software.

Answer

Configuring the firewall to block all inbound traffic.

Question 10

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

Accepted Answer

Applying the Principle of Least Privilege (PoLP) to user file shares.. Defense-in-depth requires multiple layers of security to ensure that if one control fails, others are present to mitigate the impact. For ransomware, this includes preventing the execution, limiting the scope of damage through permissions, and maintaining immutable backups. These layers ensure that an attacker must overcome multiple, diverse obstacles to achieve their objective of data encryption, significantly increasing the difficulty of a successful attack.

Answer

Disabling all network connections to the endpoint.

Answer

Enabling guest access for easier file sharing across departments.