GSEC Endpoint Security Practice Question
A small business wants to protect its Windows endpoints from malware delivered through email attachments and malicious websites. The owner asks a security consultant for a single built-in Windows feature that can provide real-time antivirus scanning, cloud-based protection, and automatic updates without purchasing third-party software. Which Windows feature should the consultant recommend?
⚠ Common exam trap
Many exam-takers confuse Windows Defender Firewall with Microsoft Defender Antivirus because both share the Defender name but serve different security functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender Antivirus
Microsoft Defender Antivirus is the correct built-in Windows feature because it delivers real-time antivirus scanning, cloud-based protection, and automatic updates without additional cost. It covers files, email attachments, and web downloads, and it is managed through Windows Security, making it the single feature that satisfies the small business's malware protection needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BitLocker Drive Encryption
Why it's wrong here
BitLocker encrypts the contents of a drive to protect data at rest if the device is lost or stolen. It does not detect or remove malware, does not scan email attachments, and does not provide cloud-based protection or signature updates. While it is a valuable built-in security feature, it addresses confidentiality of stored data rather than malware prevention, so it is not the right recommendation for this scenario.
- ✗
Windows Information Protection (WIP)
Why it's wrong here
Windows Information Protection helps separate personal and corporate data and can prevent accidental data leakage, but it is not an antivirus engine. It does not scan for malware, provide cloud-based threat intelligence, or update virus definitions. WIP is a data loss prevention feature, so it does not address the requirement to protect endpoints from malware delivered via email or web browsing.
- ✗
Windows Defender Firewall
Why it's wrong here
Windows Defender Firewall filters network traffic and can block unauthorized inbound and outbound connections, but it does not scan files for malware, provide cloud-based protection, or update virus definitions. It is a network security control, not an antivirus solution. While it is a built-in Windows feature, it does not meet the requirement for real-time antivirus scanning of email attachments and web downloads.
- ✓
Microsoft Defender Antivirus
Why this is correct
Microsoft Defender Antivirus is the built-in antivirus component of Windows that provides real-time scanning, cloud-delivered protection, and automatic signature updates through Windows Update. It scans files, email attachments, and downloads, and it integrates with Windows Security. It requires no additional purchase and is enabled by default on modern Windows versions, directly matching the consultant's recommendation for a single built-in feature.
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.