A company's endpoint security policy requires that all laptops have full-disk encryption, a host firewall, and the latest patches. The security team discovers that some remote employees have disabled the firewall to use a personal VPN. What is the best way to enforce the policy while allowing VPN use?

Send a reminder email to all remote employees to re-enable the firewall.

Allow employees to disable the firewall whenever they use a VPN.

Use endpoint management to enforce the firewall policy and configure the VPN as an allowed exception.

Block all VPN traffic at the network perimeter.

A financial firm requires that endpoints only run approved software. The security team wants to enforce this policy without hindering productivity for the finance applications that are already whitelisted. Which technology is best suited for this requirement?

Application control that allows only signed executables from the vendor.

Antivirus that scans all executables before they run.

A default-deny application whitelist with a managed exception process.

Host-based intrusion prevention that monitors for exploit attempts.

In endpoint security management, what is the primary goal of continuous monitoring?

To prevent users from accessing non-work-related websites

To ensure that endpoints are running the latest operating system version

To reduce the number of software licenses needed

To detect security incidents and anomalies on endpoints in a timely manner

Which endpoint protection technology is primarily responsible for inspecting network traffic to and from an endpoint and blocking unauthorized connections?

Intrusion prevention system (IPS)

GIAC Security Essentials

Domain 4Objective 2

Endpoint Security GSEC Practice Questions (Page 2)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 6–10

6application · medium
A company's endpoint security policy requires that all laptops have full-disk encryption, a host firewall, and the latest patches. The security team discovers that some remote employees have disabled the firewall to use a personal VPN. What is the best way to enforce the policy while allowing VPN use?
Select an answer first
7application · medium
A financial firm requires that endpoints only run approved software. The security team wants to enforce this policy without hindering productivity for the finance applications that are already whitelisted. Which technology is best suited for this requirement?
Select an answer first
8foundation · easy
In endpoint security management, what is the primary goal of continuous monitoring?
Select an answer first
9foundation · easy
Which endpoint protection technology is primarily responsible for inspecting network traffic to and from an endpoint and blocking unauthorized connections?
Select an answer first
10foundation · easy
Which type of malware is specifically designed to spread from one endpoint to another without user interaction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Endpoint Security GSEC Practice Questions (Page 2)

Questions 6–10

A financial firm requires that endpoints only run approved software. The security team wants to enforce this policy without hindering productivity for the finance applications that are already whitelisted. Which technology is best suited for this requirement?

In endpoint security management, what is the primary goal of continuous monitoring?

Which endpoint protection technology is primarily responsible for inspecting network traffic to and from an endpoint and blocking unauthorized connections?

Which type of malware is specifically designed to spread from one endpoint to another without user interaction?

Keep studying — Endpoint and Platform Security