Endpoint Security GSEC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is migrating from on-premises servers to cloud-based productivity applications. The security team wants to ensure that endpoints are protected against web-based threats. The company has a limited budget and cannot afford a full EDR solution. Which combination of controls would provide the most cost-effective protection?

   • AA cloud-based web filter and a host-based firewall with default-deny outbound rules.
   • BA strict application whitelist and user training.
   • CA traditional antivirus and regular patch management.
   • DA network-based intrusion prevention system (IPS) at the internet gateway.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An employee receives an email that appears to be from the company's CEO, asking the employee to purchase gift cards and send the codes. The email's domain is slightly misspelled (e.g., company.com vs. cornpany.com). The employee clicks the link and enters their credentials on a fake login page. Which type of attack has occurred, and which endpoint control would have been most effective in preventing the credential theft?

   • APhishing; a host-based firewall that blocks the fake domain.
   • BSpear phishing; an antivirus that scans the email attachment.
   • CPhishing; a web filter that blocks known phishing sites and a browser extension that warns about lookalike domains.
   • DSpear phishing; an EDR solution that detects the fake login page.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A small business wants to harden its Windows workstations against common malware and unauthorized changes. The owner wants a solution that is low-cost and does not require additional software purchases. Which hardening measure is most effective and immediately applicable?

   • ASet all users as local administrators so they can install updates quickly.
   • BDisable the Windows Firewall to improve network performance.
   • CRemove all third-party applications from the workstations.
   • DEnable Windows Defender Application Control to block all unsigned executables.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a mix of Windows and macOS endpoints. The security team wants to enforce a policy that requires full-disk encryption on all endpoints. The team also needs to be able to remotely wipe a device if it is lost or stolen. Which solution provides centralized management for both platforms?

   • AUse a unified endpoint management (UEM) platform that supports both Windows and macOS.
   • BUse only Microsoft Intune, which supports both Windows and macOS.
   • CConfigure encryption locally on each device and rely on users to report loss.
   • DDeploy a separate management solution for each OS and manually coordinate policies.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization's EDR solution alerts on a workstation that is beaconing to a known command-and-control domain. The alert includes the process name, the user, and the destination IP. The security team needs to determine if other endpoints are affected. Which EDR capability is most useful for this?

   • AThreat hunting that searches for similar network connections across all endpoints.
   • BReviewing the antivirus logs for that workstation.
   • CRebuilding the workstation from a known good image.
   • DQuarantining the single workstation.
   Reveal Solution Discussion Select an answer first