Courseiva

CCNA Endpoint Protection Questions

35 questions · Endpoint Protection · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

Select 3 answers
A.Sysmon Event ID 10 (ProcessAccess) indicating access to lsass.exe by unverified tools
B.Regular scheduled defragmentation of the system volume by dfrgui.exe
C.Standard domain user successfully changing their own account password via Ctrl+Alt+Del
D.Unsigned or unknown binaries executing from temporary paths (e.g., C:\Users\Public) and opening handles to LSASS
E.Windows Security Event ID 4656 or 4663 showing handle requests to lsass.exe with PROCESS_VM_READ permissions
AnswersA, D, E

Sysmon Event ID 10 logs process access with the granted access mask, so lsass.exe being accessed by unverified tools reveals memory-read attempts against the credential store. This is the specific telemetry artefact indicating credential dumping rather than routine authentication activity.

Why this answer

Option A is correct because Sysmon Event ID 10 (ProcessAccess) specifically logs when a process opens a handle to another process, and access to lsass.exe by unverified or unusual tools is a classic credential-dumping indicator (e.g., Mimikatz or procdump). Option D is correct because unsigned or unknown binaries running from writable user paths like C:\Users\Public and then opening handles to LSASS combine two strong red flags: masquerading/execution from atypical locations plus direct LSASS access. Option E is correct because Windows Security Event IDs 4656/4663 record handle requests to objects, and a request to lsass.exe with PROCESS_VM_READ (0x0010) is exactly the permission needed to read LSASS memory for credential extraction.

Option B is not relevant because dfrgui.exe performing scheduled defragmentation is normal system maintenance and does not touch LSASS memory. Option C is not relevant because a standard user changing their own password via Ctrl+Alt+Del is a legitimate, expected activity that does not involve dumping LSASS credentials.

Exam trap

CND often tests the ability to distinguish normal system activities from malicious credential dumping indicators, and candidates may overlook that legitimate processes can also access LSASS, but the combination of unsigned binaries and specific access rights is key.

Practice this question →
2
MCQmedium

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

A.Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall
B.Computer Configuration -> Preferences -> Control Panel Settings -> Network Options
C.Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties -> Outbound connections
D.Computer Configuration -> Policies -> Software Restriction Policies
AnswerC

Configuring the outbound default action to Block in the domain profile's Properties satisfies the requirement to deny all outbound traffic except explicitly permitted rules. This firewall-level default, applied via GPO to all targeted computers, enforces the deny-by-default posture before any allow rules are evaluated.

Why this answer

In Windows Defender Firewall with Advanced Security, the default outbound action (Allow or Block) is configured per profile under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties, then selecting each profile (Domain, Private, Public) and setting the Outbound connections radio button to Block. This is the only location in GPO where the firewall's default outbound behaviour is defined; individual rules then explicitly permit traffic.

Exam trap

CND often tests whether candidates can distinguish Administrative Templates (which contain legacy firewall toggles) from Security Settings (which contain the actual WFAS profile configuration), so the trap is picking the Administrative Templates path because it also mentions 'Windows Defender Firewall'.

How to eliminate wrong answers

Option A is wrong because Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall contains legacy policy toggles (like 'Prohibit use of Internet Connection Firewall') and does not expose the per-profile default outbound action. Option B is wrong because Preferences -> Control Panel Settings -> Network Options is for deploying legacy network configuration items, not firewall profile behaviour. Option D is wrong because Software Restriction Policies control which executables can run (AppLocker's predecessor), not network traffic direction.

Practice this question →
3
Multi-Selectmedium

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

Select 2 answers
A.Executing remote lock and remote wipe commands for lost or stolen devices
B.Allowing unrestricted installation of custom untrusted firmware packages
C.Enforcing device-wide encryption requirements
D.Disabling all over-the-air communication channels permanently
E.Removing all screen lock passcode requirements
AnswersA, C

Remote lock and wipe are core MDM enrolment actions, letting administrators secure lost or stolen tablets by forcing a lock or erasing corporate data over the air. This directly satisfies the scenario's lost-or-stolen device constraint, as MDM agents maintain a persistent management channel to issue these commands regardless of user action.

Why this answer

Option A is correct because MDM platforms universally support remote lock and remote wipe as core security actions, allowing administrators to secure or erase a lost or stolen tablet via push commands over the management channel. Option C is correct because MDM can enforce device-wide encryption requirements, such as mandating BitLocker, FileVault, or Android storage encryption, and can report or block devices that fail to meet this compliance policy. Option B is not a standard MDM security policy, since MDM is designed to restrict untrusted software and firmware rather than permit unrestricted custom firmware installation.

Option D is not standard, as MDM relies on over-the-air communication to manage devices and would not permanently disable all such channels. Option E is not a security policy, because removing screen lock passcode requirements weakens device security rather than enforcing it.

Exam trap

CND often tests whether candidates recognize that MDM policies are about enforcing security controls (lock, wipe, encryption, passcode) — options that describe disabling security or breaking management channels are distractors.

Practice this question →
4
MCQmedium

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

A.Application sideloading enforcement
B.Containerized workspace isolation
C.Remote wipe capability for lost devices
D.Network protection and Wi-Fi security inspection
AnswerD

Network protection with Wi-Fi security inspection operates at layers 2 and 3, analysing 802.11 frames and traffic patterns to identify evil-twin access points, ARP spoofing and SSL-stripping MitM attempts. This directly satisfies the stem's requirement for network-layer detection, which app-level or device-posture capabilities cannot deliver.

Why this answer

Network protection and Wi-Fi security inspection is the MTD capability that detects rogue access points, evil twins, and man-in-the-middle attacks by monitoring the device's network connections and analyzing Wi-Fi traffic for anomalies. This directly addresses the requirement to detect network-layer threats such as rogue APs and MitM attacks.

Exam trap

CND often tests the confusion between device-management capabilities (remote wipe, containerization) and threat-detection capabilities (network inspection), tricking candidates into selecting a remediation or isolation feature when the question asks for detection of network-layer attacks.

How to eliminate wrong answers

Option A is wrong because application sideloading enforcement addresses the risk of users installing apps from untrusted sources — it is an app-layer control, not a network-layer detection capability, and does nothing to detect rogue Wi-Fi or MitM attacks. Option B is wrong because containerized workspace isolation separates corporate and personal data on the device, which protects data confidentiality but does not detect or prevent network-layer attacks like rogue APs. Option C is wrong because remote wipe is a remediation capability for lost or stolen devices, not a detection capability for network threats, and it is irrelevant to the rogue AP/MitM scenario.

Practice this question →
5
MCQmedium

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

A.Enforcing a passcode policy with complexity and auto-lock requirements
B.Disabling Apple Push Notification service (APNs)
C.Enabling AirDrop for all contacts
D.Enabling iCloud Backup for all application data
AnswerA

A passcode policy with complexity and auto-lock enforces cryptographic key derivation from user credentials, so iOS and iPadOS encrypt data at rest via the Secure Enclave and Data Protection classes. Without it, files remain unprotected once the device locks, failing the baseline's data-at-rest requirement.

Why this answer

Data-at-rest protection on iOS/iPadOS is anchored in the Secure Enclave and the Data Protection API, which derives encryption keys from the device passcode. Without a strong passcode policy enforced via MDM (complexity, minimum length, auto-lock timeout), the encryption keys are trivially derivable and data at rest is effectively unprotected. MDM payloads such as com.apple.security.FDERecoveryKeyEscrow and Passcode Policy enforce these controls across supervised devices.

Exam trap

CND often tests the difference between controls that protect data in transit (APNs, TLS) and data at rest (passcode/Data Protection) — the trap is selecting a cloud or connectivity feature that sounds security-related but does not encrypt local storage.

How to eliminate wrong answers

Option B is wrong because disabling APNs would break MDM communication and push notifications — APNs is the transport for MDM commands and has nothing to do with data-at-rest encryption. Option C is wrong because enabling AirDrop for all contacts increases the attack surface for data exfiltration and unauthorized file transfer; it does not protect data at rest. Option D is wrong because enabling iCloud Backup for all application data actually moves corporate data off-device to Apple's cloud, which may violate data residency and increases exposure rather than protecting data at rest.

Practice this question →
6
MCQeasy

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

A.Network Packet Capture (PCAP)
B.Hardware Diagnostics
C.Process Lineage and Tree Visualization
D.Disk Defragmentation
AnswerC

Process lineage and tree visualisation reconstructs parent-child relationships from recorded process-creation events, letting the analyst trace the suspicious child back through its spawning chain. This directly satisfies the stem's requirement to review the process lineage tree, exposing the originating parent and any intermediate processes that other EDR views, such as raw event logs, would obscure.

Why this answer

Process lineage and tree visualization reconstructs the parent-child relationships between processes (e.g., winword.exe → powershell.exe → cmd.exe), letting analysts see the full execution chain that led to a suspicious child process. This is a core EDR capability because it exposes attack patterns like Office macros spawning scripting engines — a hallmark of phishing and fileless malware. Without lineage, an isolated alert on the child process lacks the context needed to determine whether it is malicious.

Exam trap

The trap here is confusing network-centric evidence (PCAP) with endpoint process telemetry — candidates who equate 'investigation' with packet capture pick the wrong tool.

How to eliminate wrong answers

Option A is wrong because PCAP captures raw network packets and provides no visibility into local process parent-child relationships on the endpoint. Option B is wrong because hardware diagnostics (CPU, memory, disk health) are unrelated to process execution analysis. Option D is wrong because disk defragmentation is a storage optimization task with zero forensic or investigative value.

Practice this question →
7
MCQeasy

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

A.Stop and disable the Windows Plug and Play service
B.Enable BitLocker To Go on all internal drives
C.Disable the USB Enhanced Host Controller Interface (EHCI) in BIOS across all endpoints
D.Configure 'Prevent installation of devices using drivers that match these device setup classes' for USB storage class
AnswerD

Blocking the USB storage device setup class prevents installation of mass storage drivers while leaving smart cards and input devices untouched, since those belong to different device classes. This satisfies the policy's requirement to block only USB mass storage.

Why this answer

Group Policy's 'Prevent installation of devices using drivers that match these device setup classes' setting lets administrators block entire device setup classes (like USB mass storage, GUID {53f56307-b6bf-11d0-94f2-00a0c91efb8b}) while allowing other USB classes such as smart cards and HID input devices. This is the precise, class-based approach required by the policy.

Exam trap

CND often tests whether candidates choose a surgical, class-based GPO restriction versus blunt-force options (disabling PnP, EHCI, or reinstalling the OS) that break legitimate USB devices.

How to eliminate wrong answers

Option A is wrong because disabling Plug and Play would break all device detection, including keyboards, mice, and smart cards — far too broad and disruptive. Option B is wrong because BitLocker To Go encrypts removable drives but does not block them; users could still mount unencrypted or unauthorized USB storage. Option C is wrong because disabling EHCI in BIOS disables all USB 2.0 ports, blocking keyboards, mice, and smart cards along with storage — it also fails on USB 3.0 (xHCI) systems.

Practice this question →
8
MCQeasy

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

A./etc/fstab
B./boot/grub/grub.cfg
C./etc/modprobe.d/blacklist.conf
D./etc/sysctl.conf
AnswerC

Blacklisting modules in `/etc/modprobe.d/blacklist.conf` prevents the kernel from loading USB storage and Bluetooth drivers at boot, directly reducing the minimal Linux kernel's attack surface. This file is read by modprobe during module initialisation, satisfying the industrial IoT constraint of disabling unnecessary kernel modules.

Why this answer

Kernel module blacklisting on Linux is configured in files under /etc/modprobe.d/, conventionally /etc/modprobe.d/blacklist.conf, using the 'blacklist <module>' directive. This prevents the module from being auto-loaded by udev or other mechanisms during boot or hotplug events. For a minimal IoT kernel, this is the standard way to disable USB storage (usb-storage) and Bluetooth (bluetooth, btusb) modules.

Exam trap

The trap is confusing kernel module configuration with bootloader or sysctl configuration — candidates often pick grub.cfg because it 'controls boot behavior', but module blacklisting lives in /etc/modprobe.d/.

How to eliminate wrong answers

Option A is wrong because /etc/fstab defines filesystem mount points and options at boot, not kernel module loading behavior. Option B is wrong because /boot/grub/grub.cfg is the generated GRUB bootloader configuration — while you can pass kernel parameters like 'modprobe.blacklist=' on the kernel command line, the canonical and persistent configuration file for module blacklisting is in /etc/modprobe.d/. Option D is wrong because /etc/sysctl.conf configures runtime kernel parameters (e.g., net.ipv4.ip_forward, kernel.randomize_va_space), not module loading.

Practice this question →
9
MCQeasy

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

A.Windows PowerShell Operational Log (Event ID 4104)
B.System Event Log (Event ID 7045)
C.Security Event Log (Event ID 4688)
D.Windows Defender Operational Log (Event ID 1116)
AnswerA

Event ID 4104 in the PowerShell Operational log records script block logging, capturing the decoded content of obfuscated or encoded commands. This directly satisfies the analyst's need to read the plaintext script, which the command-line process auditing (4688) and transcription logs would not reliably reconstruct.

Why this answer

The Windows PowerShell Operational Log records script block logging events, specifically Event ID 4104, which captures the decoded contents of script blocks executed by PowerShell. When an encoded command is run, PowerShell decodes it internally, and if script block logging is enabled, the decoded script is written to this log. This makes Event ID 4104 the correct source for retrieving the actual script contents, not just the encoded command line.

Exam trap

CND often tests the misconception that process creation logging (Event ID 4688) captures decoded script contents, when in fact it only shows the command line as executed, which may be encoded.

How to eliminate wrong answers

Option B is wrong because System Event Log Event ID 7045 indicates a new service was installed, which is unrelated to PowerShell script content. Option C is wrong because Security Event Log Event ID 4688 logs process creation, including the command line, but does not decode encoded PowerShell scripts. Option D is wrong because Windows Defender Operational Log Event ID 1116 reports malware detection events, not PowerShell script block contents.

Practice this question →
10
MCQhard

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

A.fdisk partition manager
B.gnupg keychain agent
C.cryptsetup-reencrypt
D.clevis and systemd-cryptsetup
AnswerD

Clevis binds the LUKS volume to TPM 2.0 PCR measurements, sealing the keys so systemd-cryptsetup unlocks the disk automatically at boot without a passphrase. This satisfies the stem's requirement for unattended decryption via the TPM chip, unlike passphrase-only or network-bound alternatives.

Why this answer

Clevis and systemd-cryptsetup are used together to enable automatic decryption of LUKS-encrypted volumes using a TPM 2.0 chip. Clevis provides a framework for automated decryption, and systemd-cryptsetup integrates with systemd to unlock the volume during boot without manual passphrase entry.

Exam trap

CND often tests the specific tools required for TPM-based automatic decryption of LUKS, and candidates may confuse encryption management tools with decryption automation tools.

How to eliminate wrong answers

Option A is wrong because fdisk is a partition management tool and does not handle encryption key decryption. Option B is wrong because gnupg keychain agent is for managing GPG keys and is not used for LUKS automatic decryption via TPM. Option C is wrong because cryptsetup-reencrypt is used to re-encrypt LUKS volumes, not for automatic decryption during boot.

Practice this question →
11
MCQmedium

A security analyst at a financial firm is reviewing endpoint telemetry and observes a process named 'svchost.exe' with an unusual parent process and a command line containing a Base64-encoded string. The analyst suspects a fileless attack leveraging a built-in Windows utility. Which of the following endpoint detection techniques is MOST effective for identifying this type of malicious activity?

A.Signature-based antivirus scanning of the svchost.exe file on disk
B.Scanning the Windows Registry for autorun entries associated with svchost.exe
C.Reviewing Windows Defender Firewall logs for outbound connections from svchost.exe
D.Monitoring process creation events with command-line auditing and parent-child process relationships
AnswerD

Fileless attacks often use legitimate system binaries like PowerShell or WMI to execute malicious code. By auditing process creation events (e.g., via Windows Event ID 4688 or Sysmon Event ID 1) and analyzing command-line arguments and parent-child relationships, the analyst can spot anomalies such as a suspicious parent spawning svchost.exe with encoded commands. This behavioral approach detects the attack without relying on file signatures.

Why this answer

The attack uses a legitimate Windows binary with an encoded command line and an unusual parent process, which are hallmarks of fileless malware. Monitoring process creation with command-line auditing and parent-child relationships allows detection of such anomalous behavior. Signature-based scanning, firewall logs, and registry autorun checks do not provide the necessary process-level context to identify this activity.

Exam trap

The trap here is assuming that because svchost.exe is a legitimate system process, it cannot be malicious; attackers often abuse trusted binaries to evade detection.

Practice this question →
12
MCQhard

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

A.Uninstall the third-party disk encryption driver permanently
B.Boot into Safe Mode and adjust the EDR driver start type or use sensor configuration exclusions
C.Reinstall the Windows operating system with a clean image
D.Disable Secure Boot in UEFI settings
AnswerB

Safe Mode loads only essential drivers, preventing the EDR kernel driver and the encryption filter from loading together, which stops the boot-time BSOD. Adjusting the driver start type or applying sensor exclusions then isolates the conflict before normal boot resumes.

Why this answer

Booting into Safe Mode loads only essential drivers, preventing the EDR kernel-mode driver from starting and allowing administrative access to the system. Once in Safe Mode, the administrator can change the EDR driver's start type (e.g., from boot-start to demand-start) or apply sensor configuration exclusions to prevent the conflict with the third-party disk encryption filter driver. This isolates the conflicting driver without removing critical security controls or data protection.

Exam trap

CND often tests the misconception that disabling Secure Boot or reinstalling the OS is a quick fix for driver conflicts, but the correct first step is always to isolate the conflicting driver using Safe Mode and adjust its start type or exclusions.

How to eliminate wrong answers

Option A is wrong because uninstalling the third-party disk encryption driver permanently would remove full-disk encryption, exposing data at rest and violating compliance requirements; the conflict should be resolved without sacrificing encryption. Option C is wrong because reinstalling Windows with a clean image is a drastic, time-consuming action that would destroy existing configurations and data, and it does not guarantee the conflict won't recur if the same EDR and encryption drivers are reinstalled. Option D is wrong because disabling Secure Boot weakens platform security and does not address the driver conflict; Secure Boot is unrelated to the kernel-mode driver loading order or compatibility.

Practice this question →
13
MCQmedium

A security administrator is deploying a Mobile Device Management (MDM) solution for corporate-owned Android devices. The administrator needs to ensure that if a device is lost or stolen, corporate data can be remotely wiped while preserving the user's personal data. Which of the following MDM capabilities should the administrator implement?

A.Device encryption
B.Selective wipe (corporate data wipe)
C.Full device wipe
D.Remote lock
AnswerB

A selective wipe, also known as a corporate data wipe, removes only corporate data such as email, documents, and managed apps, while leaving personal data intact. This is ideal for scenarios where the device is lost or stolen and the organization wants to protect sensitive information without affecting the user's personal content. It directly satisfies the requirement.

Why this answer

A selective wipe (corporate data wipe) is designed to remove only corporate data from a device, leaving personal data untouched. This is the appropriate MDM capability when the goal is to protect corporate information on a lost or stolen device without destroying the user's personal data. Full device wipe, remote lock, and device encryption do not achieve selective removal.

Exam trap

The trap here is choosing full device wipe because it sounds more secure, but it fails to preserve personal data, which is explicitly required.

Practice this question →
14
Multi-Selectmedium

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Select 2 answers
A.Running the WSUS Server Cleanup Wizard periodically
B.Configuring WSUS to automatically install all pre-release beta patches on domain controllers
C.Manually editing the WSUS SQL database tables directly without backups
D.Disabling transport layer security (TLS) for client communication to speed up scans
E.Approving and declining superseded updates regularly
AnswersA, E

Running the Server Cleanup Wizard periodically satisfies the ongoing maintenance requirement by removing superseded updates, unused content files, expired updates and obsolete computers from the WSUS database. Without this, the database and content store grow unchecked, degrading console performance and synchronisation reliability across the internal patch-management environment.

Why this answer

Option A is correct because the WSUS Server Cleanup Wizard removes obsolete updates, unused update revisions, expired updates, and unneeded content files, which prevents the SUSDB from growing unbounded and keeps synchronization and reporting healthy. Option E is correct because regularly approving needed updates and declining superseded or expired ones ensures clients receive only current patches and reduces unnecessary disk usage, scan time, and administrative confusion. Option B is wrong because automatically installing pre-release beta patches on domain controllers is risky and not a maintenance best practice; production servers should receive tested, released updates.

Option C is wrong because directly editing WSUS SQL tables without backups can corrupt the SUSDB and is unsupported. Option D is wrong because disabling TLS weakens client-server communication security and does not constitute healthy WSUS maintenance.

Exam trap

CND often tests the misconception that aggressive automation (auto-installing beta patches) or disabling security (TLS) is acceptable for convenience — candidates must recognize that cleanup and update lifecycle management are the correct maintenance tasks.

Practice this question →
15
Multi-Selecthard

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Select 3 answers
A.Enforcing SELinux in targeted or multi-category security (MLS) mode
B.Setting all user home directory permissions to world-writable (chmod 777)
C.Disabling all audit logging and accounting daemons
D.Enforcing AppArmor profiles for critical network-facing daemons
E.Configuring kernel sysctl parameters to restrict core dumps and kernel pointer leaks (e.g., kptr_restrict=2)
AnswersA, D, E

SELinux enforces kernel-level Mandatory Access Control, confining processes to policy-defined domains regardless of user identity. Targeted mode restricts specific daemons, while MLS applies Bell-LaPadula style sensitivity labels, both satisfying the requirement to restrict process privileges beyond discretionary controls.

Why this answer

Option A is correct because SELinux is a Linux MAC implementation, and running it in enforcing mode (targeted or MLS) applies mandatory type/level policy that confines processes beyond standard discretionary permissions. Option D is correct because AppArmor enforces per-program MAC profiles, so confining critical network-facing daemons limits what files, capabilities, and network operations they can access even if compromised. Option E is correct because sysctl hardening such as fs.suid_dumpable=0 and kernel.kptr_restrict=2 restricts privilege-relevant information leaks and core dumps that could expose kernel addresses or sensitive process memory.

Option B is incorrect because chmod 777 makes home directories world-writable, weakening access control rather than enforcing MAC or least privilege. Option C is incorrect because disabling audit logging and accounting removes accountability and monitoring, which does not restrict process privileges and undermines hardening.

Exam trap

CND often tests the misconception that 'hardening' means loosening permissions or disabling logging for convenience, so candidates pick world-writable homes or auditd shutdown as if they were simplifications rather than regressions.

Practice this question →
16
MCQmedium

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

A.Software Update Groups
B.Maintenance Windows
C.Automatic Deployment Rules (ADR)
D.Client Settings - Computer Restart
AnswerB

Maintenance Windows define precise schedules during which MECM may deploy patches, restarting devices only within that period. Configuring a window outside active hours directly satisfies the minimal-disruption constraint, since installations and reboots are suppressed during business use and enforced only within the defined boundary.

Why this answer

Maintenance Windows in MECM define a scheduled time range during which deployments (including software updates) are permitted to install and, critically, when restarts may occur. Configuring a maintenance window outside active hours ensures patches install and reboots happen without disrupting users. This is the MECM feature purpose-built for controlling when updates apply on a schedule.

Exam trap

The trap is selecting Automatic Deployment Rules because they sound like they control timing — but ADRs govern deployment creation, while Maintenance Windows govern when installation and restarts actually occur on clients.

How to eliminate wrong answers

Option A is wrong because Software Update Groups are containers that organize updates for deployment — they define what to deploy, not when installation and restarts are allowed. Option C is wrong because Automatic Deployment Rules automate the creation and deployment of update groups on a schedule, but they do not control the client-side installation window or restart timing. Option D is wrong because Client Settings - Computer Restart controls restart behavior (countdown, grace period, notifications) but does not define a permitted installation window; without a maintenance window, restarts can still occur during active hours.

Practice this question →
17
MCQeasy

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

A.Windows Defender Application Control (WDAC)
B.User Account Control (UAC)
C.BitLocker Drive Encryption
D.Windows Defender Credential Guard
AnswerD

Credential Guard uses Virtualisation-Based Security to run LSASS in an isolated Hyper-V-protected container, so NTLM and Kerberos secrets cannot be read by a compromised process. This satisfies the stem's requirement to isolate LSASS memory using virtualisation against pass-the-hash.

Why this answer

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate LSASS and its derived credentials in a separate, hypervisor-protected container. This prevents tools like Mimikatz from reading NTLM hashes or Kerberos tickets out of LSASS memory, directly mitigating pass-the-hash. It requires UEFI Secure Boot, virtualization extensions, and is enabled via Group Policy or Intune.

Exam trap

CND often tests the misconception that disk encryption (BitLocker) or application control (WDAC) protects in-memory credentials, when only VBS-based Credential Guard isolates LSASS.

How to eliminate wrong answers

Option A is wrong because WDAC is an application control mechanism that restricts which binaries can run; it does not isolate LSASS memory or protect credential material. Option B is wrong because UAC gates privilege elevation prompts and token filtering — it has no role in protecting credential storage from memory scraping. Option C is wrong because BitLocker encrypts data at rest on the disk; once the OS is running and credentials are in memory, BitLocker provides no protection against pass-the-hash.

Practice this question →
18
Multi-Selectmedium

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

Select 2 answers
A.Setting a strong UEFI/BIOS administrator password to prevent unauthorized configuration changes
B.Leaving the physical chassis intrusion detection switch disconnected
C.Configuring the boot order to prioritize booting from unverified USB flash drives first
D.Enabling UEFI Secure Boot to prevent unauthorized bootloaders and rootkits
E.Disabling Trusted Platform Module (TPM) activation across all systems
AnswersA, D

A UEFI/BIOS administrator password blocks unauthorised entry into firmware setup, preventing attackers with physical access from disabling Secure Boot, altering boot order or flashing malicious firmware. This directly satisfies the stem's requirement to harden client endpoints against BIOS/UEFI tampering.

Why this answer

Option A is correct because setting a strong UEFI/BIOS administrator password prevents unauthorized users from entering firmware setup and altering security-relevant settings such as boot order, virtualization, or disabling protections, directly mitigating physical/firmware tampering. Option D is correct because UEFI Secure Boot validates the digital signatures of bootloaders and early boot components against trusted keys, blocking unauthorized bootloaders and rootkits from loading before the OS. Option B is wrong because leaving the chassis intrusion detection switch disconnected removes a physical-tamper detection control rather than adding one.

Option C is wrong because prioritizing unverified USB boot devices weakens boot security and enables rogue boot media attacks. Option E is wrong because disabling TPM activation removes hardware-rooted key storage and measured-boot capabilities that support integrity and tamper detection.

Exam trap

CND often tests the misconception that a BIOS password alone provides complete firmware protection, or that Secure Boot and TPM are interchangeable — candidates must recognize they are complementary layers, not substitutes.

Practice this question →
19
MCQmedium

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

A.arp.exe or ipconfig.exe
B.calc.exe
C.mspaint.exe
D.notepad.exe
AnswerA

arp.exe and ipconfig.exe are signed Microsoft utilities that enumerate ARP caches and network adapter configuration. Because they are trusted, allow-listed binaries, attackers use them for internal reconnaissance without dropping tools, so EDR behavioural rules must baseline and alert on their anomalous execution.

Why this answer

arp.exe and ipconfig.exe are native, signed Windows utilities that attackers routinely abuse for network discovery — arp -a enumerates the local ARP cache to map hosts, and ipconfig /all reveals IP configuration, DNS servers, and adapters. Because they are legitimate Microsoft binaries, they often bypass application allowlisting and blend into normal admin activity, making them classic living-off-the-land binaries (LotLBs) that EDR behavioral rules must monitor.

Exam trap

The trap is picking a familiar Windows executable that has been abused for sideloading (calc, mspaint) instead of the ones whose native function is actually network discovery — the exam tests whether you know the specific LotLB use case, not just that a binary is 'abusable'.

How to eliminate wrong answers

Option B is wrong because calc.exe is a calculator with no network discovery capability; while it has been abused historically for DLL sideloading, it is not a reconnaissance tool. Option C is wrong because mspaint.exe is an image editor and, like calc, is only relevant to binary-planting or sideloading techniques, not network enumeration. Option D is wrong because notepad.exe is a text editor; it can be used to read files or as a script host in rare cases, but it does not perform network discovery.

Practice this question →
20
MCQhard

A CND analyst is reviewing endpoint hardening for a fleet of Windows 11 laptops that use BitLocker with TPM 2.0. The organization wants to prevent an attacker with brief physical access from booting the machine from removable media or reaching a recovery prompt to extract the drive. Which pre-boot control should the analyst verify is enabled in UEFI firmware?

A.Measured Boot with TPM PCR logging
B.UEFI firmware password with boot order locked to the internal drive
C.BitLocker Network Unlock
D.Secure Boot
AnswerB

A UEFI firmware password gates entry to setup, and locking the boot order to the internal disk prevents an attacker with brief physical access from booting a USB or optical device or altering boot options. Combined with BitLocker's TPM protector, this blocks the removable-media and recovery-prompt paths described. It is the firmware control that directly addresses the scenario's requirement.

Why this answer

The requirement is to stop an attacker with brief physical access from booting alternate media or reaching a recovery prompt to extract the BitLocker-protected drive. A UEFI firmware password combined with a boot order locked to the internal drive directly prevents that alternate boot path. Secure Boot, Network Unlock, and Measured Boot address boot integrity, PIN delivery, and attestation respectively, but none of them blocks a firmware boot-order change.

Exam trap

The trap here is assuming BitLocker with a TPM protector alone prevents offline access, when an attacker with physical access can still alter firmware boot order unless a firmware password and locked boot order are set.

Practice this question →
21
MCQeasy

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

A.Disk Management (diskmgmt.msc)
B.Windows Server Backup
C.Object Access Auditing via Advanced Audit Policy Configuration
D.Task Scheduler
AnswerC

Object Access Auditing via Advanced Audit Policy Configuration generates Windows security events when monitored files are modified, enabling alerting on unauthorised changes. This satisfies the stem's requirement for automatic monitoring of critical system files using a built-in feature.

Why this answer

Windows Object Access Auditing, configured through Advanced Audit Policy Configuration (under Security Settings -> Advanced Audit Policy Configuration -> Object Access), lets administrators audit access to files and folders, including modifications. When combined with a System Access Control List (SACL) on critical files, any write, delete, or permission change generates a Security event (e.g., 4663) that can trigger alerts via SIEM or Windows Event Forwarding. This is the built-in mechanism for file integrity monitoring on Windows.

Exam trap

CND often tests whether candidates confuse backup tools (Windows Server Backup) or scheduling tools (Task Scheduler) with actual auditing/monitoring features, so the trap is picking a tool that can be scripted to check files rather than the built-in audit policy that natively generates modification events.

How to eliminate wrong answers

Option A is wrong because Disk Management (diskmgmt.msc) is for partitioning, formatting, and managing volumes — it has no file integrity or change-monitoring capability. Option B is wrong because Windows Server Backup creates and restores backups; it does not monitor files for unauthorized modification or generate alerts on change. Option D is wrong because Task Scheduler runs scheduled jobs — it can execute a script that checks file hashes, but it is not a built-in monitoring/alerting feature for file modifications on its own.

Practice this question →
22
Multi-Selectmedium

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

Select 2 answers
A.Requires rooting or jailbreaking the mobile device during enrollment
B.Enforces separation of corporate apps and data from personal user applications
C.Prevents the use of any passcode on the device
D.Allows IT administrators to execute a selective wipe of corporate data without affecting personal data
E.Gives IT full administrative control over personal photos, messages, and personal app usage
AnswersB, D

A containerized work profile creates a cryptographically separated managed partition on the device, so corporate apps and data cannot interact with personal apps. This satisfies the stem's requirement by enforcing the boundary that distinguishes work profile from device-owner or fully managed modes.

Why this answer

Option B is correct because a containerized work profile (e.g., Android Enterprise work profile) creates a cryptographically and logically isolated container where corporate apps, accounts, and data are kept separate from the user's personal apps and data, enforced by the OS. Option D is correct because this separation enables a selective (enterprise) wipe that removes only the work profile and its corporate data while leaving personal photos, messages, and apps intact. Option A is incorrect because work profiles are a native OS feature that does not require rooting or jailbreaking; in fact, rooting/jailbreaking typically breaks the security model and is prohibited.

Option C is incorrect because work profiles actually support and often require a secure passcode or biometric for the work container, not the removal of passcodes. Option E is incorrect because the whole point of the container is to limit IT visibility and control to the corporate container, not to grant access to personal photos, messages, or personal app usage.

Exam trap

The trap here is confusing containerization with full device management (MDM) — candidates pick options implying IT gets total control over the whole device, when the defining feature of a work profile is the boundary that limits IT's reach to corporate data only.

Practice this question →
23
MCQmedium

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

A.Local Users and Groups (lusrmgr.msc)
B.Local Security Policy (secpol.msc)
C.Group Policy Management Console (gpmc.msc)
D.System Configuration (msconfig.exe)
AnswerB

secpol.msc edits the local security database, covering password complexity, minimum length and account lockout thresholds on standalone machines. Domain Group Policy cannot apply without Active Directory, so the local policy console is the only mechanism meeting the standalone constraint.

Why this answer

Local Security Policy (secpol.msc) is the Microsoft Management Console snap-in that exposes Account Policies — including Password Policy (complexity, minimum length, history) and Account Lockout Policy — for standalone Windows systems not governed by domain Group Policy. It writes to the local security database and is the correct tool for non-domain-joined endpoints.

Exam trap

The trap is confusing lusrmgr.msc (user/group management) with secpol.msc (security policy) — CND tests whether candidates know which MMC snap-in exposes password and lockout settings.

How to eliminate wrong answers

Option A is wrong because lusrmgr.msc manages local users and groups (creation, group membership) but does not expose password complexity, length, or lockout settings. Option C is wrong because gpmc.msc manages domain-based Group Policy Objects and requires Active Directory; it cannot target standalone servers. Option D is wrong because msconfig.exe controls boot configuration and startup services, not security policy.

Practice this question →
24
Multi-Selecthard

An organization is implementing comprehensive endpoint hardening for Windows 10/11 endpoints. Which THREE of the following measures directly contribute to reducing the attack surface against memory-based exploits and credential theft? (Choose THREE)

Select 3 answers
A.Enabling Windows Defender Exploit Protection system settings (e.g., CFG, DEP, ASLR)
B.Disabling Universal Plug and Play (UPnP) service on endpoints
C.Enabling Windows Defender Credential Guard
D.Configuring Attack Surface Reduction (ASR) rules
E.Disabling the Server Message Block v1 (SMBv1) protocol
AnswersA, C, D

Windows Defender Exploit Protection enforces control-flow integrity, data execution prevention and address space layout randomisation at the process level, blocking the memory-corruption primitives that memory-based exploits rely on. This directly satisfies the stem's requirement to harden Windows 10/11 endpoints against memory-based exploit techniques.

Why this answer

Option A is correct because Windows Defender Exploit Protection enforces memory-corruption mitigations such as Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), which directly harden processes against memory-based exploits. Option C is correct because Credential Guard uses virtualization-based security (VBS) to isolate LSA secrets in a protected environment, preventing tools like Mimikatz from harvesting NTLM hashes and Kerberos tickets. Option D is correct because Attack Surface Reduction (ASR) rules block behaviors commonly used in exploit chains and credential theft, such as Office child-process creation, script-based execution, and credential dumping via lsass.

Option B does not belong because disabling UPnP removes a network discovery/port-mapping convenience feature and does not mitigate memory exploits or credential theft. Option E does not belong because disabling SMBv1 addresses lateral movement and legacy protocol vulnerabilities (e.g., WannaCry) rather than memory-based exploitation or credential dumping on the endpoint itself.

Exam trap

The trap is treating any Windows hardening measure (UPnP, SMBv1) as equivalent to memory/credential protections, when only Exploit Protection, Credential Guard, and ASR target those specific threat classes.

Practice this question →
25
MCQmedium

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

A./etc/ssh/sshd_config
B./etc/security/limits.conf
C./etc/environment
D./etc/profile
AnswerD

/etc/profile is sourced by login shells for all users, so a umask set there applies system-wide and ensures newly created files are not group- or world-readable, satisfying the stem's hardening requirement. Per-user dotfiles would not cover the whole fleet.

Why this answer

/etc/profile is a system-wide shell initialization script sourced by login shells for all users, making it the correct place to set a default umask that applies globally. Setting 'umask 027' or 'umask 077' here ensures every new file created by users inherits restrictive permissions. This is the standard Linux hardening practice for fleet-wide permission defaults.

Exam trap

CND often tests whether candidates confuse shell initialization files (/etc/profile) with PAM resource-limit files (/etc/security/limits.conf) or environment-only files (/etc/environment) when asked where to set a system-wide umask.

How to eliminate wrong answers

Option A is wrong because /etc/ssh/sshd_config controls SSH daemon behavior (authentication, ciphers, port), not filesystem permission defaults. Option B is wrong because /etc/security/limits.conf sets resource limits (nofile, nproc, core) via PAM, not umask values. Option C is wrong because /etc/environment only sets environment variables for PAM-based logins and does not execute the umask shell builtin, so it cannot enforce a default umask.

Practice this question →
26
MCQhard

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

A.unhide
B.lsof -i
C.netstat -anp
D.ps aux --forest
AnswerA

Unhide cross-references the kernel system call table against raw kernel memory, exposing processes whose PIDs user-space rootkits have unlinked from /proc. This directly satisfies the requirement to detect hooks hiding PIDs, which ordinary process listings cannot reveal.

Why this answer

unhide is a forensic utility specifically designed to detect hidden processes and TCP/UDP ports by cross-referencing multiple data sources, including the kernel system call table (via /proc and syscall hooks) against direct kernel memory reads. User-space rootkits commonly hook syscalls like getdents or read on /proc to filter out malicious PIDs from tools like ps, so a tool that bypasses those hooks is required. unhide's 'checkbrute' and 'checkall' modes compare /proc listings, /bin/ps output, and kernel memory to expose discrepancies.

Exam trap

The trap here is assuming that standard process-listing tools (ps, lsof, netstat) are trustworthy on a compromised host — CND tests whether you know that rootkits specifically target those tools and that a cross-referencing forensic utility is required.

How to eliminate wrong answers

Option B is wrong because lsof -i only lists open files and network sockets from the /proc filesystem — it relies on the same potentially hooked interfaces and will not reveal a PID hidden by a user-space rootkit. Option C is wrong because netstat -anp reads /proc/net/tcp and /proc/net/udp, which can also be manipulated by a rootkit hooking those paths, and it does not perform kernel memory comparison. Option D is wrong because ps aux --forest reads /proc directly and is exactly the tool a user-space rootkit is designed to deceive — it will not show the hidden process.

Practice this question →
27
Multi-Selecthard

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

Select 3 answers
A.Configuring all system accounts with shared static SSH keys and root auto-login
B.Configuring a host-based packet filter firewall (such as nftables or iptables)
C.Removing unnecessary software packages and disabling unused network services (e.g., Telnet, FTP)
D.Establishing an automated, secure mechanism for firmware and patch updates
E.Disabling local logging and audit daemons to maximize CPU performance
AnswersB, C, D

A host-based packet filter enforces least-privilege network access directly on the gateway, restricting inbound and outbound traffic to only the required industrial protocols and management ports. This satisfies the stem's embedded Linux hardening requirement by reducing the exposed attack surface independently of any upstream network controls.

Why this answer

Option B is correct because a host-based packet filter such as nftables or iptables enforces least-privilege network access on the gateway itself, restricting inbound/outbound traffic to only the ports and protocols the industrial IoT function requires. Option C is correct because reducing the attack surface by removing unnecessary packages and disabling insecure legacy services like Telnet and FTP (which transmit credentials in cleartext) eliminates well-known vectors for compromise on embedded Linux endpoints. Option D is correct because an automated, secure firmware and patch update mechanism ensures known vulnerabilities are remediated promptly and integrity-verified, which is essential for long-lived IoT devices that cannot rely on manual updates.

Option A is not a hardening practice: shared static SSH keys and root auto-login destroy accountability and enable lateral movement, whereas best practice is unique per-device keys, disabled root SSH login, and key-based authentication with passphrases. Option E is not a hardening practice: disabling local logging and audit daemons removes the forensic and detection capability needed to identify intrusions and is not an acceptable trade-off for marginal CPU savings.

Exam trap

CND often tests whether candidates recognize that 'performance optimization' answers (disabling logging) are almost always wrong in security hardening questions — visibility is a security control, not overhead.

Practice this question →
28
MCQhard

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

A.find / -attr +s -type d
B.find / -perm -4000 -type f 2>/dev/null
C.locate -i suid_binaries
D.chmod -R 755 /
AnswerB

The -perm -4000 predicate matches files whose permission bits include the SUID bit, and -type f restricts results to regular files. Redirecting stderr to /dev/null suppresses permission-denied noise, satisfying the requirement to enumerate SUID binaries across the root partition.

Why this answer

The SUID bit is represented by the octal permission value 4000, so 'find / -perm -4000 -type f' locates all regular files with that bit set. The '-type f' restricts results to files (not directories), and '2>/dev/null' suppresses permission-denied errors from unreadable directories. This is the canonical command for auditing SUID binaries during Linux hardening.

Exam trap

The trap is confusing the SUID octal value — candidates may pick 1000 (sticky bit) or 2000 (SGID) instead of 4000, or forget that '-type f' is needed to exclude directories.

How to eliminate wrong answers

Option A is wrong because '-attr +s' is not a valid find predicate for the SUID bit — the correct attribute syntax uses '-perm' with octal or symbolic modes, and '-type d' would search directories, which cannot carry SUID meaningfully. Option C is wrong because 'locate' queries a prebuilt filename database and cannot filter by permission bits; it also has no concept of SUID. Option D is wrong because 'chmod -R 755 /' would recursively strip SUID/SGID bits and set world-readable/executable permissions across the entire filesystem, breaking the system rather than auditing it.

Practice this question →
29
MCQhard

A security engineer is hardening a fleet of Windows 10 endpoints against credential theft. The engineer wants to prevent attackers from extracting plaintext passwords or NTLM hashes from memory. Which of the following Windows features should the engineer enable to achieve this goal?

A.Windows Defender Firewall with Advanced Security
B.BitLocker Drive Encryption
C.AppLocker
D.Credential Guard
AnswerD

Credential Guard uses virtualization-based security to isolate secrets such as NTLM hashes and Kerberos tickets in a protected process that only system software can access. This prevents tools like Mimikatz from extracting credentials from LSASS memory. Enabling Credential Guard directly addresses the goal of preventing credential theft from memory, making it the correct choice for this scenario.

Why this answer

Credential Guard is designed to isolate and protect credential material using virtualization-based security, preventing extraction from memory. AppLocker, Windows Defender Firewall, and BitLocker address different security concerns—application control, network filtering, and data-at-rest encryption—and do not prevent in-memory credential dumping. Thus, Credential Guard is the appropriate feature to enable.

Exam trap

The trap here is confusing data-at-rest protection (BitLocker) or application control (AppLocker) with in-memory credential protection, which requires virtualization-based isolation.

Practice this question →
30
MCQhard

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

A.Configuring devices in personal use profile mode
B.Disabling installation from unknown sources and enforcing Managed Google Play accounts
C.Disabling factory reset protection (FRP)
D.Enabling USB debugging mode for all users
AnswerB

Disabling unknown sources blocks sideloading of APKs outside Managed Google Play, while Managed Google Play accounts deliver and auto-update approved corporate apps. Together these satisfy both constraints: preventing untrusted installs and ensuring automatic updates through the managed store.

Why this answer

To prevent users from installing apps from unknown sources and ensure corporate apps update automatically, the EMM/MDM policy should disable installation from unknown sources and enforce Managed Google Play accounts. This configuration restricts app installation to approved sources and allows automatic updates through Managed Google Play.

Exam trap

CND often tests Android Enterprise security policies, and candidates may confuse personal use profiles with work profiles or overlook the importance of Managed Google Play for automatic updates.

How to eliminate wrong answers

Option A is wrong because personal use profile mode does not enforce corporate app management and may allow unknown sources. Option C is wrong because disabling factory reset protection (FRP) is unrelated to app installation policies and could weaken security. Option D is wrong because enabling USB debugging mode for all users increases attack surface and does not prevent unknown source installations.

Practice this question →
31
MCQeasy

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

A.Disk Defragmentation
B.Remote Device Wipe
C.Remote Host Isolation / Network Containment
D.Cloud Sandbox Submission
AnswerC

Remote host isolation severs the endpoint's network connections while leaving the machine powered on, preserving volatile memory such as running processes and encryption keys. Shutting down would destroy that evidence, so containment satisfies the stem's forensic requirement.

Why this answer

Remote Host Isolation (network containment) is the EDR capability that severs an endpoint's network connectivity while leaving the machine powered on, preserving volatile memory (RAM) for forensic analysis. This matches the IR team's requirement to disconnect without shutting down, allowing memory capture of ransomware artifacts, encryption keys, and process state. It is the standard containment action in modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Exam trap

The trap is confusing containment (isolate but preserve) with remediation actions like wipe or shutdown, which destroy the volatile evidence the IR team explicitly wants to keep.

How to eliminate wrong answers

Option A is wrong because Disk Defragmentation is a maintenance operation that rearranges files on disk and has no security or containment function — it would also destroy forensic artifacts. Option B is wrong because Remote Device Wipe erases the endpoint, destroying the volatile memory and disk evidence the IR team needs to preserve. Option D is wrong because Cloud Sandbox Submission sends files for detonation analysis in a sandbox; it does not contain the infected host or stop the ransomware from spreading.

Practice this question →
32
MCQmedium

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

A.Manually download and install MSI installers via local administrator logon scripts
B.Disable all third-party software on endpoints
C.Rely exclusively on Microsoft Windows Update for Business
D.Integrate third-party software patch catalogs into MECM or a dedicated Patch Management tool
AnswerD

Importing vendor patch catalogues into MECM or a dedicated patch tool lets the organisation detect, approve and deploy third-party updates through one automated pipeline. This directly addresses the stem's constraint: browsers and PDF readers dominating missing patches across the Windows fleet.

Why this answer

Third-party applications (browsers, PDF readers, Java, etc.) are not covered by Microsoft's native update channels, so the scalable solution is to integrate third-party patch catalogs (e.g., Patch My PC, Ivanti, or vendor catalogs) into MECM or a dedicated patch management platform. This automates detection, download, and deployment of third-party updates alongside Microsoft patches.

Exam trap

CND often tests the assumption that Windows Update for Business or WSUS natively patches third-party software — candidates must recognize that only Microsoft products are covered unless a third-party catalog integration is explicitly deployed.

How to eliminate wrong answers

Option A is wrong because manually downloading and installing MSI installers via logon scripts does not scale, lacks version detection, and creates reliability and privilege issues. Option B is wrong because disabling all third-party software is operationally infeasible and does not address the vulnerability management requirement. Option C is wrong because Windows Update for Business only delivers Microsoft product updates — it does not patch third-party applications like Chrome or Adobe Reader.

Practice this question →
33
Multi-Selecthard

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

Select 3 answers
A.Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events)
B.PowerShell script block logging (Event ID 4104) capturing WMI class instantiations (e.g., [wmiclass])
C.The Master Boot Record (MBR) partition table sectors
D.The system HOSTS file in \Windows\System32\drivers\etc\
E.WMI permanent event subscriptions located in the \root\subscription namespace (EventFilters, EventConsumers, FilterToConsumerBindings)
AnswersA, B, E

Microsoft-Windows-WMI-Activity/Operational records WMI operation failures and client activity, including Event ID 5858, which logs failed WMI operations with the originating process, command line and namespace. This directly satisfies the stem's requirement to examine WMI logging mechanisms, exposing the malicious script or process that issued the fileless WMI commands.

Why this answer

Option A is correct because the Microsoft-Windows-WMI-Activity/Operational log records WMI operational activity, including Event ID 5858, which captures failed or suspicious WMI operations and is a primary source for detecting fileless WMI abuse. Option B is correct because PowerShell script block logging (Event ID 4104) records the actual script content, including WMI class instantiations such as [wmiclass], allowing investigators to see malicious WMI calls executed through PowerShell. Option E is correct because WMI persistence in fileless attacks is commonly implemented via permanent event subscriptions in the \root\subscription namespace, where EventFilters, EventConsumers, and FilterToConsumerBindings reveal the trigger, action, and binding used for persistence.

Option C is not relevant because the MBR partition table sectors relate to disk boot structures and are not WMI artifacts or WMI logging mechanisms. Option D is not relevant because the HOSTS file is used for local name resolution and is unrelated to WMI activity or WMI-based fileless malware.

Exam trap

CND often tests the misconception that fileless malware leaves no artifacts, causing candidates to overlook WMI logs and subscriptions, or to incorrectly select disk-based artifacts like MBR or HOSTS file.

Practice this question →
34
MCQhard

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

A.Windows Defender Real-time Protection is enabled
B.The Application Identity service (AppIDSvc) is stopped or disabled
C.BitLocker encryption is not enabled on the system drive
D.Fast Startup is enabled in the BIOS
AnswerB

AppLocker enforcement depends on the Application Identity service to evaluate and apply rules. If AppIDSvc is stopped or disabled, rules are not enforced, so unsigned executables from user-writable paths still run despite the publisher rule.

Why this answer

AppLocker relies on the Application Identity service (AppIDSvc) to evaluate and enforce rules. If AppIDSvc is stopped or disabled, AppLocker policies are not applied, allowing all executables to run regardless of configured rules. The administrator's rule to allow signed apps would be ignored, and unsigned tools from user-writable directories would execute freely.

Exam trap

CND often tests the misconception that AppLocker rules are enforced solely by policy configuration, overlooking the dependency on the Application Identity service (AppIDSvc) being running and set to automatic.

How to eliminate wrong answers

Option A is wrong because Windows Defender Real-time Protection is an antivirus feature that scans for malware; it does not enforce AppLocker rules and would not prevent unsigned tools from running if AppLocker is not enforced. Option C is wrong because BitLocker is a disk encryption feature that protects data at rest; it has no role in application control or AppLocker enforcement. Option D is wrong because Fast Startup is a power management feature that affects boot behavior; it does not interfere with AppLocker's rule enforcement.

Practice this question →
35
Multi-Selectmedium

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Select 2 answers
A.Disabling SELinux or AppArmor enforcement
B.Setting a restrictive default umask (such as 027) in shell profiles
C.Configuring PermitRootLogin no in /etc/ssh/sshd_config
D.Enabling password authentication with zero minimum length in PAM
E.Mounting all filesystems with read-write and suid privileges
AnswersB, C

A restrictive umask such as 027 strips group-write and all other permissions from newly created files and directories, preventing world-readable or world-writable artefacts that enable local privilege escalation and unauthorised access on hardened Linux servers.

Why this answer

Option B is correct because setting a restrictive default umask such as 027 in shell profiles (e.g., /etc/profile or /etc/bashrc) ensures newly created files are not world-readable or group-writable, reducing exposure of sensitive data and limiting opportunities for local attackers to tamper with files. Option C is correct because configuring PermitRootLogin no in /etc/ssh/sshd_config prevents direct SSH logins as root, forcing administrators to authenticate as unprivileged users and then escalate via sudo or su, which strengthens accountability and blocks a common brute-force path to full system compromise. The unmarked options do not belong: disabling SELinux or AppArmor (A) removes mandatory access control enforcement and weakens containment of compromised processes, enabling password authentication with zero minimum length in PAM (D) permits weak or empty passwords that are trivially guessed or brute-forced, and mounting all filesystems read-write with suid privileges (E) increases the attack surface by allowing setuid binaries to execute and by permitting modification of system files.

Exam trap

The trap is selecting options that sound like 'flexibility' (password auth, read-write SUID mounts) — candidates must recognize that hardening means restricting, not enabling, these features.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Endpoint Protection questions.

Start 20-question session