Endpoint Security Windows Systems CND Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A defense contractor wants to protect domain credentials stored in LSASS from credential-dumping attacks on Windows 10 Enterprise workstations. They also want to ensure that only signed and trusted code can run in kernel mode. Which two Windows features should you enable?

   • AEnable Credential Guard and Device Guard (Hypervisor-protected Code Integrity).
   • BEnable AppLocker and set the UAC slider to 'Always notify'.
   • CEnable BitLocker and configure Windows Defender Firewall to block all inbound traffic.
   • DEnable Windows Defender Exploit Guard's ASR rules and set the audit policy to log all logon events.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which Windows feature, formerly known as Device Guard, provides kernel-mode code integrity (KMCI) and user-mode code integrity (UMCI) to ensure that only trusted code can run?

   • AWindows Defender Application Control (WDAC)
   • BAppLocker
   • CCredential Guard
   • DWindows Defender Exploit Guard
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst needs to detect attempts to access sensitive files on a Windows file server. They want to log both successful and failed access attempts to the sensitive folder, and they want to ensure the logs are not overwritten quickly. Which configuration should you set?

   • AEnable Account Logon auditing and set the security log maximum size to 1 MB.
   • BUse Windows Defender Firewall to log all inbound connections to the file server.
   • CEnable Windows Defender Antivirus to scan the sensitive folder and log all detections.
   • DEnable Object Access auditing in the security policy and configure the SACL on the folder to audit 'Everyone' for 'Read' and 'Write' with 'Success' and 'Failure'.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A manufacturing company's Windows 10 endpoints are frequently targeted by exploit kits that use script-based attacks. The security team wants to block malicious scripts while allowing legitimate PowerShell scripts used by IT. Which Windows Defender Exploit Guard feature should be configured?

   • AEnable network protection in block mode to prevent all outbound connections from PowerShell.
   • BSet Windows Defender Antivirus to disable real-time protection and rely on periodic scans.
   • CEnable Attack Surface Reduction (ASR) rules for blocking Office child processes and script obfuscation, and add folder exclusions for the IT scripts.
   • DConfigure Controlled Folder Access to block all PowerShell access to user documents.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which Group Policy setting enforces a minimum length for user passwords, thereby strengthening password security?

   • AMinimum password length
   • BMaximum password age
   • CAccount lockout threshold
   • DPassword must meet complexity requirements
   Reveal Solution Discussion Select an answer first