Endpoint Protection

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

A security analyst at a financial firm is reviewing endpoint telemetry and observes a process named 'svchost.exe' with an unusual parent process and a command line containing a Base64-encoded string. The analyst suspects a fileless attack leveraging a built-in Windows utility. Which of the following endpoint detection techniques is MOST effective for identifying this type of malicious activity?

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

A security administrator is deploying a Mobile Device Management (MDM) solution for corporate-owned Android devices. The administrator needs to ensure that if a device is lost or stolen, corporate data can be remotely wiped while preserving the user's personal data. Which of the following MDM capabilities should the administrator implement?

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

A CND analyst is reviewing endpoint hardening for a fleet of Windows 11 laptops that use BitLocker with TPM 2.0. The organization wants to prevent an attacker with brief physical access from booting the machine from removable media or reaching a recovery prompt to extract the drive. Which pre-boot control should the analyst verify is enabled in UEFI firmware?

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

An organization is implementing comprehensive endpoint hardening for Windows 10/11 endpoints. Which THREE of the following measures directly contribute to reducing the attack surface against memory-based exploits and credential theft? (Choose THREE)

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

A security engineer is hardening a fleet of Windows 10 endpoints against credential theft. The engineer wants to prevent attackers from extracting plaintext passwords or NTLM hashes from memory. Which of the following Windows features should the engineer enable to achieve this goal?

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)