Endpoint Security Windows Systems CND Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A law firm requires that all USB flash drives used by attorneys be encrypted so that data is unreadable if a drive is lost. The firm also wants to prevent unencrypted USB drives from being used on their Windows 10 laptops. Which control should the administrator implement?

   • AEnable BitLocker To Go and configure Group Policy to require encryption before allowing write access to removable drives.
   • BEnable BitLocker on the system drive and rely on the TPM to protect all data on the laptop.
   • CConfigure the registry to disable the 'Removable Storage' service on all laptops.
   • DUse Windows Defender Application Control to block all USB devices from being mounted.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which Group Policy setting determines how many failed logon attempts can occur before a user account is locked out?

   • AAccount lockout threshold
   • BEnforce password history
   • CReset account lockout counter after
   • DAccount lockout duration
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A hospital's Windows workstations must allow only the electronic health record (EHR) application to receive inbound connections from the hospital's internal network. All other inbound traffic should be blocked. The workstations are joined to the domain and use the Domain profile. Which Windows Firewall with Advanced Security configuration should the administrator implement?

   • ACreate an inbound block rule for all applications except the EHR application, and leave the default inbound action as Allow.
   • BSet the Domain profile's outbound default action to Block and create an outbound allow rule for the EHR application.
   • CDisable the firewall on the Domain profile and rely on the network switch's access control lists to filter traffic.
   • DCreate an inbound allow rule for the EHR application's executable, and set the Domain profile's inbound default action to Block.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company's helpdesk staff use standard user accounts, but occasionally need to install approved software on their own Windows 10 workstations. Management wants to minimize UAC prompts while still requiring an administrator password for elevation. Which configuration should you implement?

   • AConfigure the 'Admin Approval Mode' policy to prompt for credentials on the secure desktop, and keep helpdesk users as standard users.
   • BEnable the 'Built-in Administrator account' and have helpdesk users log on with it when installing software.
   • CSet the UAC slider to 'Never notify' and add helpdesk users to the local Administrators group.
   • DSet the UAC policy to 'Automatically deny elevation requests' and provide helpdesk with a separate admin account for installs.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which hardware component is recommended for BitLocker Drive Encryption to provide the strongest protection by storing encryption keys outside the OS drive?

   • AHardware Security Module (HSM)
   • BUnified Extensible Firmware Interface (UEFI)
   • CTrusted Platform Module (TPM)
   • DSolid-state drive (SSD)
   Reveal Solution Discussion Select an answer first