Endpoint Security Windows Systems CND Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized company's security operations center (SOC) wants to detect advanced threats on Windows endpoints that evade traditional antivirus. The company already uses Windows Defender Antivirus and wants to integrate with a cloud-based EDR platform. Which action should the administrator take?

   • ADeploy a third-party EDR agent and disable Windows Defender Antivirus to avoid conflicts.
   • BEnable Windows Defender Exploit Guard and configure ASR rules to block all scripts.
   • COnboard the endpoints to Microsoft Defender for Endpoint and configure the EDR connector to stream alerts to the SOC's SIEM.
   • DConfigure Windows Defender Antivirus to send samples to Microsoft and enable cloud-delivered protection.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which Windows Defender Antivirus feature allows administrators to specify folders that are always excluded from real-time scanning, which can be necessary for performance but may increase risk?

   • AExclusions
   • BControlled folder access
   • CTamper protection
   • DCloud-delivered protection
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial firm's Windows 10 endpoints run a legacy line-of-business application that requires an older version of Java. The security team wants to prevent users from installing or running any other executable, but the legacy app must still function. Which approach should the administrator take?

   • AEnable Windows Defender Exploit Guard network protection and set it to Block mode.
   • BDeploy a Windows Defender Antivirus exclusion for the legacy app folder and rely on real-time protection to block unknown executables.
   • CCreate an AppLocker executable rule that allows the legacy app's folder and the Java path, then set default executable rules to Deny.
   • DConfigure a Group Policy security template that sets the 'Run as different user' policy to disabled for all users.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Windows security feature uses virtualization-based security (VBS) to isolate and protect domain credentials from credential theft attacks such as pass-the-hash?

   • ACredential Guard
   • BBitLocker
   • CDevice Guard
   • DWindows Defender Antivirus
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which tool is commonly used in enterprise environments to manage and deploy Windows updates to multiple systems from a central server?

   • AGroup Policy Management Console
   • BMicrosoft Update Catalog
   • CWindows Server Update Services (WSUS)
   • DWindows Update Standalone Installer (wusa.exe)
   Reveal Solution Discussion Select an answer first