Endpoint Security Windows Systems CND Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which data structure in Windows contains the security identifier (SID) of the user, group memberships, and privileges that are used during access checks?

   • AProcess environment block (PEB)
   • BAccess control entry (ACE)
   • CAccess token
   • DSecurity descriptor
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which type of firewall rule in Windows Firewall with Advanced Security is used to allow or block traffic that originates from the local computer and goes to a remote destination?

   • AOutbound rule
   • BInbound rule
   • CConnection security rule
   • DAuthenticated bypass rule
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's security policy requires that user passwords be at least 12 characters, that accounts lock after 5 failed attempts, and that successful logons be recorded in the security log. You need to enforce these settings on all domain-joined Windows 10 workstations. Which tool should you use?

   • ABitLocker Drive Encryption to protect the security log from tampering.
   • BGroup Policy Management Console (GPMC) to create a GPO linked to the workstation OU.
   • CWindows Defender Firewall with Advanced Security to block failed logons.
   • DLocal Security Policy on each workstation individually.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Windows 10 endpoint is suspected of being infected with a fileless malware that injects code into a trusted system process. You want to use built-in Windows protections to block this behavior without installing third-party software. Which two protections should you enable?

   • AEnable BitLocker on the system drive and configure Windows Update to defer feature updates.
   • BSet the UAC slider to 'Always notify' and disable the Windows Defender Firewall service.
   • CEnable Windows Defender Exploit Guard's Controlled Folder Access and Attack Surface Reduction rules.
   • DEnable Windows Defender Application Control (WDAC) in audit mode and set the firewall to block all inbound traffic.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A university's Windows 10 lab computers are used by students. The security team wants to enforce a policy that locks the workstation after 15 minutes of inactivity and requires a password to unlock. Which Group Policy settings should be configured?

   • AConfigure the screensaver to 'None' and set the power plan to turn off the display after 15 minutes.
   • BSet 'Interactive logon: Do not display last user name' to Enabled and set the account lockout threshold to 5.
   • CSet 'Interactive logon: Machine inactivity limit' to 900 seconds and enable the 'Interactive logon: Require Ctrl+Alt+Del' policy.
   • DEnable 'User Account Control: Switch to the secure desktop when prompting for elevation'.
   Reveal Solution Discussion Select an answer first