Endpoint Security Windows Systems CND Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial firm requires that all USB drives used by employees be encrypted so that lost devices cannot expose client data. They also want to prevent employees from using unencrypted USB drives. Which solution should you implement?

   • AEnable Windows Defender Application Control to block all USB devices except approved hardware IDs.
   • BUse Group Policy to require BitLocker To Go encryption on removable drives and set the 'Deny write access to removable drives not protected by BitLocker' policy.
   • CEnable BitLocker To Go on all fixed drives and require a startup PIN for every employee workstation.
   • DConfigure the registry to disable USB storage and rely on Windows Defender Antivirus to scan all removable media.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Windows Server 2019 host runs a legacy application that requires SMBv1. The security team wants to reduce the attack surface without breaking the application. Which approach is the best balance?

   • AEnable SMBv1 and also enable SMB signing and encryption for all connections.
   • BReplace SMBv1 with SMBv2 and configure the application to use a different protocol.
   • CDisable SMBv1 entirely and require the vendor to update the application.
   • DKeep SMBv1 enabled but restrict access to the SMB ports using Windows Firewall rules and apply the latest security patches.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Windows feature allows administrators to create rules that allow only approved applications to run on a system, using conditions such as publisher, path, or file hash?

   • AUser Account Control
   • BWindows Defender Firewall
   • CBitLocker
   • DAppLocker
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A Windows Server 2019 host runs a legacy application that requires the 'Remote Registry' service to be enabled. The security team wants to harden the server by reducing the attack surface, but the application vendor insists that Remote Registry must remain enabled. Which alternative hardening measure should the administrator implement?

   • ADisable the Remote Registry service and configure the legacy application to use a local registry mirror.
   • BRestrict Remote Registry access to specific administrators using the registry key's security descriptor and enable Windows Firewall rules to limit remote registry connections to the management subnet.
   • CSet the Remote Registry service to 'Manual' and rely on the application to start it when needed.
   • DEnable Credential Guard to protect the registry from remote access.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst needs to detect attempts to access sensitive files on Windows servers. The analyst wants to log both successful and failed access attempts to a specific folder. Which auditing configuration should be used?

   • AEnable 'Audit Process Creation' and use a script to monitor file handles.
   • BEnable 'Audit Directory Service Access' on the domain controller.
   • CEnable 'Audit Logon Events' success and failure in the local security policy.
   • DEnable 'Audit File System' success and failure in Advanced Audit Policy, and configure a SACL on the folder for 'Everyone' with Read and Write permissions.
   Reveal Solution Discussion Select an answer first