Which Windows Defender Exploit Guard component is designed to prevent malicious code from injecting into processes by applying exploit mitigation techniques such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)?

Attack surface reduction (ASR) rules

Which of the following is a key difference between AppLocker and Windows Defender Application Control (WDAC)?

AppLocker can only block executables, while WDAC can also block scripts and DLLs

AppLocker is a cloud-based service, while WDAC is an on-premises feature

WDAC is more secure because it runs in kernel mode and can be enforced even before the OS fully loads, while AppLocker runs in user mode and is easier to manage

WDAC is available on all Windows editions, while AppLocker is only available on Windows Server

A mid-sized company wants to improve visibility into endpoint threats by collecting and correlating security events from Windows workstations. They already use Windows Defender Antivirus and want to add a solution that provides centralized alerting and response capabilities. Which approach should you take?

Enable Windows Defender Firewall logging and manually review logs on each workstation.

Configure Windows Update to install all updates and rely on the built-in antivirus only.

Use BitLocker to encrypt all endpoints and store recovery keys in Active Directory.

Integrate the workstations with a third-party EDR platform and configure it to forward alerts to a SIEM.

In the Windows security architecture, which component is responsible for validating access to objects by comparing the access token of the requesting subject with the security descriptor of the target object?

Security Reference Monitor (SRM)

Local Security Authority Subsystem (LSASS)

EC-CouncilCertified Network Defender

Domain 2Objective 2

Endpoint Security Windows Systems CND Practice Questions (Page 4)

Part of the Perimeter and Endpoint Security domain, which makes up ~24% of our current practice bank.

45questions here

9free pages

12concepts

12 Concepts in This Objective

Windows Security Architecture
User Account Control (UAC)
Windows Firewall with Advanced Security
Windows Defender Antivirus and Exploit Guard
BitLocker Drive Encryption
AppLocker and Windows Defender Application Control
Credential Guard and Device Guard
Windows Update and Patch Management
Security Policies and Group Policy
Event Logging and Auditing
Endpoint Detection and Response (EDR) Integration
Hardening Windows Services and Registry

Questions 16–20

16foundation · easy
Which Windows Defender Exploit Guard component is designed to prevent malicious code from injecting into processes by applying exploit mitigation techniques such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)?
Select an answer first
17foundation · easy
Which of the following is a key difference between AppLocker and Windows Defender Application Control (WDAC)?
Select an answer first
18application · medium
A mid-sized company wants to improve visibility into endpoint threats by collecting and correlating security events from Windows workstations. They already use Windows Defender Antivirus and want to add a solution that provides centralized alerting and response capabilities. Which approach should you take?
Select an answer first
19foundation · easy
In the Windows security architecture, which component is responsible for validating access to objects by comparing the access token of the requesting subject with the security descriptor of the target object?
Select an answer first
20foundation · easy
In Windows Firewall with Advanced Security, which profile is applied when a computer is connected to a public network such as a coffee shop Wi-Fi?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Endpoint Security Windows Systems CND Practice Questions (Page 4)

Questions 16–20

Which Windows Defender Exploit Guard component is designed to prevent malicious code from injecting into processes by applying exploit mitigation techniques such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)?

Which of the following is a key difference between AppLocker and Windows Defender Application Control (WDAC)?

In the Windows security architecture, which component is responsible for validating access to objects by comparing the access token of the requesting subject with the security descriptor of the target object?

In Windows Firewall with Advanced Security, which profile is applied when a computer is connected to a public network such as a coffee shop Wi-Fi?

Keep studying — Perimeter and Endpoint Security