GSEC Endpoint Security — All Questions With Answers

Question 1

An administrator observes unauthorized lateral movement via PowerShell Remoting on a Windows network. Which security control best mitigates this risk by restricting administrative access to specific jump hosts?

Accepted Answer

Configure a WinRM listener to accept connections only from a specific jump host IP.. Restricting WinRM access to specific source IP addresses ensures that only authorized jump servers can initiate remote management sessions. This technique, known as tiered administration, limits the blast radius of compromised credentials. By enforcing network-level filtering on the endpoint, administrators prevent attackers from leveraging PowerShell Remoting from arbitrary internal workstations, directly countering credential-based lateral movement tactics prevalent in modern enterprise environments.

Answer

Disable the Windows Remote Management (WinRM) service globally.

Answer

Enable Windows Defender Credential Guard to isolate LSASS.

Answer

Implement AppLocker in 'Audit Only' mode to track PowerShell usage.

Question 2

An organization is deploying an Endpoint Detection and Response (EDR) solution. Which TWO of the following capabilities are primarily focused on post-compromise detection and investigation?

Accepted Answer

Continuous recording of process creation and command-line arguments.. EDR tools focus on behavioral analysis and forensic telemetry to identify threats that bypass traditional signature-based antivirus. By recording process execution, file modifications, and network connections, security teams can reconstruct the sequence of an attack. These capabilities are critical for incident response, allowing teams to determine the root cause, identify the scope of the infection, and perform precise remediation on affected endpoints without needing to reimage every device.

Answer

File-based signature matching against a global cloud database.

Answer

Real-time blocking of known malicious websites via DNS filtering.

Answer

Enforcement of disk encryption policies via MDM integration.

Question 3

Which configuration best protects an endpoint against 'Pass-the-Hash' (PtH) attacks involving local administrator accounts?

Accepted Answer

Disabling NTLM authentication and using Kerberos where possible.. Pass-the-Hash attacks involve an attacker using an NTLM hash or Kerberos ticket to authenticate as a user without needing their password. By restricting the usage of local administrator accounts to specific workstations via Group Policy, the scope of these credentials is minimized. Combined with credential hardening, this makes it significantly harder for an attacker to move laterally using stolen hashes from memory.

Answer

Enforcing complex passwords for local administrator accounts.

Answer

Increasing the frequency of password rotation for all users.

Answer

Installing an antivirus agent on all workstations.

Question 4

A security analyst is investigating a Windows 10 workstation that has been compromised by a fileless malware attack. The malware executed entirely in memory and left no files on disk, but the analyst suspects the malicious code was injected into a legitimate process. Which native Windows feature should the analyst examine to identify the injected code and its origin?

Accepted Answer

Windows Event Tracing for Windows (ETW) with the Microsoft-Windows-Threat-Intelligence provider. Event Tracing for Windows (ETW) with the Threat-Intelligence provider offers deep visibility into kernel and user-mode activities, including process injection and memory manipulation, which are hallmarks of fileless malware. Unlike traditional event logs or performance tools, ETW can trace the exact moment and source of code injection, enabling analysts to reconstruct the attack chain and identify the malicious process.

Answer

Windows Defender Application Control (WDAC) logs

Answer

Windows Event Logs, specifically Security event ID 4688 (Process Creation)

Answer

Windows Performance Recorder (WPR) with the CPU usage profile

Question 5

A financial institution is hardening its Linux servers against privilege escalation attacks. The security team wants to enforce that only binaries with a valid digital signature from approved vendors can execute with elevated privileges, while allowing unsigned binaries to run with normal user permissions. Which Linux kernel feature should the team implement to achieve this granular control?

Accepted Answer

Linux Integrity Measurement Architecture (IMA) with appraisal and digital signatures. Linux Integrity Measurement Architecture (IMA) with appraisal and digital signatures enables the kernel to verify the cryptographic signature of an executable before it runs. This allows a policy where only binaries signed by trusted keys can execute with elevated privileges, while unsigned binaries may still run with standard user rights. This granular control is exactly what the financial institution needs to prevent privilege escalation via tampered or malicious binaries.

Answer

seccomp filters with a whitelist of allowed system calls

Answer

SELinux in enforcing mode with a strict policy

Answer

AppArmor with profile-based confinement

Question 6

A security analyst is investigating a compromised Linux server. The attacker gained initial access via a web application vulnerability and then escalated privileges to root. The analyst needs to determine what persistence mechanisms were installed. Which of the following locations should the analyst examine FIRST to identify a malicious cron job that runs every minute?

Accepted Answer

/var/spool/cron/crontabs/root. On Debian-based Linux systems, user-specific cron jobs are stored in /var/spool/cron/crontabs/. The root user's crontab is at /var/spool/cron/crontabs/root, making it the primary location for a malicious per-minute job added by an attacker with root access. Other locations like /etc/crontab and /etc/cron.d/ are system-wide and less likely for stealthy persistence. /etc/cron.hourly/ only runs hourly, not per minute.

Answer

/etc/crontab

Answer

/etc/cron.d/

Answer

/etc/cron.hourly/

Question 7

A security analyst is hardening a fleet of Windows 10 workstations that must run only approved business applications. The analyst wants to block all unapproved executables and scripts, including those launched by users with local administrator rights, while minimizing disruption to signed Microsoft and third-party applications. Which Windows feature should the analyst implement?

Accepted Answer

AppLocker with default rules and a publisher rule for approved vendors. AppLocker is the appropriate Windows feature because it enforces application control through publisher, path, and hash rules, and its policies apply to administrators as well as standard users. Using default rules plus publisher rules for approved vendors blocks unapproved executables and scripts while allowing signed business applications to run, matching the requirement to harden endpoints without breaking approved software.

Answer

Windows Defender Firewall with outbound rules blocking unknown applications

Answer

Windows Defender Application Control (WDAC) in audit mode

Answer

Software Restriction Policies (SRP) with a disallowed-by-default rule

Question 8

Refer to the exhibit. An administrator applies this policy to a Windows workstation. What is the expected behavior for a user attempting to execute a legitimate application installed in their AppData folder?

Accepted Answer

The application will be blocked from execution.. The policy explicitly defines a 'Deny' rule for the AppData directory. Since the policy mode is set to 'Enforce', the endpoint security engine will block any executable residing in that path. This is a common security practice to prevent the execution of malicious payloads frequently dropped into temporary user directories, though it may inadvertently block legitimate software that installs to the user profile instead of Program Files.

Answer

The application will run normally because AppData is a standard location.

Answer

The application will run, but the activity will be logged for review.

Answer

The system will automatically move the application to Program Files.

Question 9

Which endpoint hardening technique is most effective at preventing unauthorized code execution by restricting the environment to only pre-approved software?

Accepted Answer

Implementing an application allowlisting solution.. Allowlisting, or application control, is the most robust method for preventing unknown or unauthorized code execution. By only allowing known, trusted binaries to run, it mitigates the risk of malware, even zero-day exploits, since the malicious code will not be on the approved list. This is a foundational strategy for high-security environments where the risk of execution must be strictly minimized.

Answer

Disabling local administrator accounts for standard users.

Answer

Enabling real-time scanning in antivirus software.

Answer

Configuring the firewall to block all inbound traffic.

Question 10

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

Accepted Answer

Applying the Principle of Least Privilege (PoLP) to user file shares.. Defense-in-depth requires multiple layers of security to ensure that if one control fails, others are present to mitigate the impact. For ransomware, this includes preventing the execution, limiting the scope of damage through permissions, and maintaining immutable backups. These layers ensure that an attacker must overcome multiple, diverse obstacles to achieve their objective of data encryption, significantly increasing the difficulty of a successful attack.

Answer

Disabling all network connections to the endpoint.

Answer

Enabling guest access for easier file sharing across departments.

Question 11

An incident responder notices suspicious memory usage on a protected host. Which endpoint forensic technique is most reliable for detecting file-less malware that resides only in RAM?

Accepted Answer

Performing a memory dump and analyzing it for anomalous process threads.. File-less malware operates by injecting malicious code directly into the memory space of legitimate system processes. Traditional disk-based scanning tools will miss this, as no malicious file exists on the filesystem. Detecting file-less attacks requires inspecting memory for anomalies, such as injected threads or hooked functions, which requires specialized tools capable of analyzing process memory structures in real-time.

Answer

Scanning the hard drive for known malicious file signatures.

Answer

Analyzing the Master File Table (MFT) for deleted entries.

Answer

Checking the Windows Event Logs for failed login attempts.

Question 12

When evaluating an endpoint's disk encryption, why is 'Pre-Boot Authentication' (PBA) considered a critical security component?

Accepted Answer

It requires authentication before the encryption keys are released to memory.. PBA ensures that the encryption keys are not loaded into memory until the user provides the correct credentials at boot time. Without PBA, the encryption is transparent once the OS starts, meaning if the device is stolen while powered on or in sleep mode, an attacker could potentially access the data. PBA provides a strong gatekeeper that protects the data at rest even before the OS loads.

Answer

It improves the speed of system startup and file indexing.

Answer

It ensures that the computer cannot be booted from an external drive.

Answer

It automatically syncs the encryption keys to a cloud-based backup.

Question 13

A Windows 10 workstation in a high-security environment must be configured so that only digitally signed and approved kernel-mode drivers can load, blocking unsigned or tampered drivers that could be used for rootkit installation. Which Windows feature should the administrator enable to enforce this requirement?

Accepted Answer

Device Guard with Code Integrity policies. Device Guard with Code Integrity policies enforces that only trusted, signed kernel-mode drivers can load, directly preventing unsigned or tampered drivers from being used for rootkits. BitLocker, AppLocker, and Windows Defender Firewall address different security concerns—data encryption, application control, and network filtering—and do not provide kernel-mode driver integrity enforcement. Therefore, Device Guard is the correct solution.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker with TPM and PIN

Answer

AppLocker with default rules

Question 14

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)

Accepted Answer

Enable Credential Guard. Credential Guard and LSA protection directly protect credentials in memory. Credential Guard isolates derived credentials using virtualization-based security, preventing their theft. LSA protection blocks non-PPL processes from reading LSA memory, thwarting credential dumping tools. SMB signing, Windows Defender Firewall, and BitLocker address other security aspects but do not directly prevent credential theft from memory.

Answer

Enable BitLocker with TPM

Answer

Enforce SMB signing

Answer

Deploy Windows Defender Firewall with domain profile

Question 15

A security team wants to implement application whitelisting on a set of Windows 10 workstations to prevent users from running unauthorized executables. They need a solution that integrates with Group Policy and allows rules based on file path, hash, or publisher. Which built-in Windows feature should they use?

Accepted Answer

AppLocker. AppLocker is the built-in Windows feature designed for application whitelisting, with rule types based on path, hash, or publisher, and it integrates with Group Policy. WDAC is more complex and less Group Policy-centric, SRP is deprecated, and Windows Defender Firewall does not control application execution. Therefore, AppLocker is the correct solution.

Answer

Software Restriction Policies (SRP)

Answer

Windows Defender Application Control (WDAC)

Answer

Windows Defender Firewall

Question 16

A security analyst is reviewing a Windows endpoint that is suspected to be compromised with a fileless malware infection. The malware is believed to have injected malicious code into a legitimate process. Which Windows tool should the analyst use to inspect the memory of running processes for signs of injection?

Accepted Answer

Process Explorer. Process Explorer provides in-depth process information, including loaded DLLs and memory contents, allowing analysts to spot suspicious or unsigned modules indicative of code injection. Task Manager, Event Viewer, and Resource Monitor lack the ability to inspect process memory in detail. Thus, Process Explorer is the correct tool for this scenario.

Answer

Resource Monitor

Answer

Task Manager

Answer

Event Viewer

Question 17

A healthcare provider must protect laptops that store electronic protected health information (ePHI). The security team wants to ensure that if a laptop is lost or stolen, the data on the drive remains confidential even if an attacker removes the drive and connects it to another computer. The team also wants to minimize the risk of cold-boot attacks that could extract encryption keys from memory. Which full disk encryption configuration best meets these requirements?

Accepted Answer

BitLocker with TPM and PIN protector, plus pre-boot authentication. BitLocker with a TPM and PIN protector enforces pre-boot authentication, so the drive cannot be unlocked without the PIN and the TPM-bound key. This protects against offline drive removal and reduces the window for cold-boot or DMA attacks because the operating system and keys are not loaded until the PIN is entered, satisfying both confidentiality and cold-boot risk reduction.

Answer

BitLocker with a startup key stored on a USB flash drive

Answer

BitLocker with TPM-only protector and no PIN

Answer

EFS encryption of the ePHI folders with user certificates

Question 18

A small business wants to protect its Windows endpoints from malware delivered through email attachments and malicious websites. The owner asks a security consultant for a single built-in Windows feature that can provide real-time antivirus scanning, cloud-based protection, and automatic updates without purchasing third-party software. Which Windows feature should the consultant recommend?

Accepted Answer

Microsoft Defender Antivirus. Microsoft Defender Antivirus is the correct built-in Windows feature because it delivers real-time antivirus scanning, cloud-based protection, and automatic updates without additional cost. It covers files, email attachments, and web downloads, and it is managed through Windows Security, making it the single feature that satisfies the small business's malware protection needs.

Answer

BitLocker Drive Encryption

Answer

Windows Information Protection (WIP)

Answer

Windows Defender Firewall

Question 19

A security team is investigating a compromised Linux server. The attacker gained initial access through a web application and then established persistence. The team wants to identify the mechanism used to maintain access across reboots. Which Linux artifact should the team examine first to find scheduled tasks that run automatically?

Accepted Answer

/etc/crontab and the /etc/cron.* directories. System-wide cron files and directories are the primary location for scheduled tasks on Linux. Attackers frequently add entries to /etc/crontab or /etc/cron.* to run malicious commands at boot or regular intervals, ensuring persistence across reboots. Examining these files first aligns with the goal of identifying how the attacker maintains access after a restart.

Answer

/etc/hosts

Answer

/var/log/auth.log

Answer

/etc/passwd

Question 20

A security administrator is implementing endpoint hardening on a fleet of Windows 10 laptops. The administrator wants to reduce the attack surface by disabling or restricting features that are commonly abused by attackers. Which TWO of the following actions are appropriate endpoint hardening measures? (Choose two.)

Accepted Answer

Enable PowerShell Constrained Language Mode for all users. Disabling Windows Script Host and enforcing PowerShell Constrained Language Mode both reduce the attack surface by limiting common attacker execution techniques. WSH is often abused for script-based malware, and Constrained Language Mode restricts PowerShell's ability to load arbitrary code. Together they harden endpoints without requiring third-party tools, while the other options either weaken security or introduce conflicts.

Answer

Disable User Account Control (UAC) to improve user productivity

Answer

Install a second third-party antivirus alongside Microsoft Defender Antivirus

Answer

Enable the Guest account and assign it a blank password for temporary access

GSEC Endpoint Security — All Questions With Answers

An administrator observes unauthorized lateral movement via PowerShell Remoting on a Windows network. Which security control best mitigates this risk by restricting administrative access to specific jump hosts?

An organization is deploying an Endpoint Detection and Response (EDR) solution. Which TWO of the following capabilities are primarily focused on post-compromise detection and investigation?

Which configuration best protects an endpoint against 'Pass-the-Hash' (PtH) attacks involving local administrator accounts?

Refer to the exhibit. An administrator applies this policy to a Windows workstation. What is the expected behavior for a user attempting to execute a legitimate application installed in their AppData folder?

Exhibit

Which endpoint hardening technique is most effective at preventing unauthorized code execution by restricting the environment to only pre-approved software?

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

An incident responder notices suspicious memory usage on a protected host. Which endpoint forensic technique is most reliable for detecting file-less malware that resides only in RAM?

When evaluating an endpoint's disk encryption, why is 'Pre-Boot Authentication' (PBA) considered a critical security component?

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)

GSEC Endpoint Security — All Questions With Answers

An administrator observes unauthorized lateral movement via PowerShell Remoting on a Windows network. Which security control best mitigates this risk by restricting administrative access to specific jump hosts?

An organization is deploying an Endpoint Detection and Response (EDR) solution. Which TWO of the following capabilities are primarily focused on post-compromise detection and investigation?

Which configuration best protects an endpoint against 'Pass-the-Hash' (PtH) attacks involving local administrator accounts?

Refer to the exhibit. An administrator applies this policy to a Windows workstation. What is the expected behavior for a user attempting to execute a legitimate application installed in their AppData folder?

Exhibit

Which endpoint hardening technique is most effective at preventing unauthorized code execution by restricting the environment to only pre-approved software?

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

An incident responder notices suspicious memory usage on a protected host. Which endpoint forensic technique is most reliable for detecting file-less malware that resides only in RAM?

When evaluating an endpoint's disk encryption, why is 'Pre-Boot Authentication' (PBA) considered a critical security component?

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)