GSEC Endpoint Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable User Account Control (UAC) to improve user productivity

  Why it's wrong here

  Disabling UAC removes the prompt that requires elevation for administrative actions, allowing processes to run with higher privileges without user consent. This increases the risk of privilege escalation and silent malware execution. UAC is a security boundary that helps prevent unauthorized changes, so disabling it is the opposite of hardening. It would weaken endpoint security rather than reduce the attack surface.

• ✗

  Install a second third-party antivirus alongside Microsoft Defender Antivirus

  Why it's wrong here

  Running two antivirus products simultaneously can cause performance issues, conflicts, and false positives, and it may force Microsoft Defender Antivirus into passive mode. It does not add layered protection in a reliable way and can leave gaps if one product interferes with the other. The scenario asks for hardening measures, and installing a competing antivirus is not a recommended way to reduce attack surface.

• ✗

  Enable the Guest account and assign it a blank password for temporary access

  Why it's wrong here

  Enabling the Guest account with a blank password creates an easily exploitable entry point. Attackers can use it to gain initial access or move laterally without credentials. Best practice is to keep the Guest account disabled. This action increases the attack surface rather than reducing it, so it is not an appropriate endpoint hardening measure for the administrator to implement.

• ✓

  Enable PowerShell Constrained Language Mode for all users

  Why this is correct

  Constrained Language Mode restricts PowerShell to a limited set of language features and blocks access to arbitrary .NET types and COM objects. This significantly hinders attackers who rely on PowerShell for fileless malware and post-exploitation. Enforcing it for all users is a valid hardening step that reduces the attack surface while still allowing many administrative scripts to run, so it is an appropriate measure.

• ✓

  Disable the Windows Script Host (WSH) to prevent execution of .vbs and .js scripts

  Why this is correct

  Disabling Windows Script Host prevents the execution of VBScript and JScript files, which are frequently used in phishing and malware campaigns to download or execute payloads. This reduces the attack surface without affecting most legitimate business applications. It is a recognized endpoint hardening measure that directly limits a common attacker technique, making it an appropriate action for the administrator to take.