Endpoint Security GSEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A hospital's IT department is deploying new Windows workstations for nurses. The workstations will be used for charting and medication administration. The security team wants to minimize the attack surface while ensuring nurses can perform their duties. Which approach is most appropriate?

   • AGrant nurses local administrator rights so they can install needed software.
   • BAllow all USB devices to connect for convenience.
   • CDisable the host firewall to allow communication with medical devices.
   • DUse a standard user account and whitelist the specific clinical applications.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a mix of Windows and Linux servers. The security team wants to deploy a host-based intrusion prevention system (HIPS) that can also provide file integrity monitoring. The team has a limited budget and wants to minimize the number of agents. Which approach is best?

   • ADeploy separate HIPS and file integrity monitoring tools for each OS.
   • BUse only antivirus on Windows and rely on Linux's built-in security.
   • CDeploy a single EDR solution that includes HIPS and file integrity monitoring for both OSes.
   • DDeploy HIPS only on Windows and use manual checks on Linux.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital's IT team deploys new Windows workstations for nurses. The workstations will access patient records via a web portal and also run a legacy medical device application that requires local administrator rights. The security team wants to reduce the risk of malware infection from malicious websites while still allowing the legacy application to function. Which approach best meets these requirements?

   • AInstall a web filter that blocks all categories except medical reference sites, and leave the users as local administrators.
   • BDeploy an EDR agent and rely on its behavioral detection to stop any malware that runs, without changing user privileges.
   • CRun the legacy application under a standard user account with a compatibility shim that elevates only that application.
   • DConfigure the host-based firewall to block all outbound traffic except to the hospital's web portal and update servers.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A user clicks on a link in a phishing email and is taken to a website that automatically downloads a malicious file. The file is a new, unknown malware variant. Which endpoint security control is most likely to detect this threat?

   • AHost-based intrusion prevention system (HIPS)
   • BSignature-based antivirus
   • CA web filter that blocks known malicious domains
   • DApplication whitelisting
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's endpoint security team is overwhelmed by alerts from multiple tools. They want to reduce alert fatigue and improve response efficiency. Which approach is most effective?

   • AAssign one analyst to manually review every alert.
   • BDisable all alerts and rely on periodic manual scans.
   • CIntegrate endpoint detection and response (EDR) with a security information and event management (SIEM) system to correlate alerts.
   • DIncrease the number of alerts by enabling all detection rules.
   Reveal Solution Discussion Select an answer first