Endpoint Security Windows Systems CND Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which registry hive contains configuration settings that apply to all users on a Windows system, making it a common target for hardening and malware persistence?

   • AHKEY_LOCAL_MACHINE (HKLM)
   • BHKEY_CLASSES_ROOT (HKCR)
   • CHKEY_USERS (HKU)
   • DHKEY_CURRENT_USER (HKCU)
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of User Account Control (UAC) in Windows?

   • ATo encrypt the user's profile data on disk to protect it from offline attacks
   • BTo automatically block all software that is not signed by a trusted publisher
   • CTo run all applications with the least privilege necessary, prompting for consent or credentials when administrative rights are required
   • DTo provide a secure desktop for all user interactions, preventing any screen capture
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which component is typically installed on a Windows endpoint to collect telemetry data and send it to an EDR management console?

   • AEDR agent
   • BSecurity Descriptor
   • CWindows Defender Firewall
   • DGroup Policy Object (GPO)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security administrator is investigating a suspicious process on a Windows 10 endpoint. The process is running under a user account and has attempted to access a file that the user does not have permission to read. The administrator wants to understand why the access was denied. Which Windows security component is responsible for evaluating the user's access token against the file's security descriptor?

   • AThe Windows Firewall with Advanced Security
   • BThe Security Reference Monitor (SRM)
   • CThe Credential Guard isolated process
   • DThe User Account Control (UAC) filter
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hospital IT team wants to ensure that only approved medical applications can run on Windows 10 workstations, while still allowing IT staff to run administrative tools from a specific folder. They prefer a solution that is built into Windows and can be managed via Group Policy. Which approach should you choose?

   • AEnable Windows Defender Exploit Guard's network protection and set the firewall to block all outbound traffic.
   • BDeploy AppLocker with executable rules that allow the approved medical apps and a separate path rule for the IT tools folder.
   • CSet the UAC level to 'Always notify' and require administrator approval for every application launch.
   • DInstall a third-party EDR agent and configure it to block all unsigned executables.
   Reveal Solution Discussion Select an answer first