An EDR solution alerts on a workstation that is running a known vulnerable version of a remote access tool. The tool is used by IT for remote support. The vendor has released a patch, but applying it requires a reboot that would disrupt ongoing remote support sessions. What is the best course of action?

Disable the remote support tool until the patch is applied.

Schedule the patch during a maintenance window and temporarily increase monitoring.

Apply the patch immediately and accept the disruption.

Do not patch until the remote support tool is no longer needed.

A company is deploying a new endpoint security tool that requires local administrator privileges to install. The security team is concerned about the principle of least privilege. Which approach best balances the need to install the tool with the principle of least privilege?

Create a local administrator account on each machine for installation and leave it enabled.

Grant all users local administrator rights temporarily and remove them after installation.

Use a software deployment tool that runs with elevated privileges in the system context.

Have each user manually install the software using their own administrator credentials.

A company is deploying new laptops to a sales team that travels frequently. The laptops will store customer data. The security team wants to ensure data is protected if a laptop is lost or stolen. Which control is most important?

A BIOS password that prevents booting.

Full-disk encryption with a strong pre-boot password.

A tracking sticker with the company logo.

A screensaver with a 5-minute timeout.

Which capability is typically provided by an Endpoint Detection and Response (EDR) solution?

Automatically patching all software vulnerabilities

Forensic analysis of endpoint activity to determine the scope of an attack

Encrypting the entire hard drive of the endpoint

Blocking all network traffic to and from the endpoint

A company's finance team frequently receives targeted phishing emails with malicious Office documents. The endpoint security team wants to reduce the risk of macro-based malware executing on Windows workstations while minimizing disruption to legitimate document workflows. Which configuration best addresses this risk?

Configure application control to allow only signed macros from approved internal templates and block unsigned macros.

Enable a host-based firewall rule that blocks inbound SMB traffic on all finance workstations.

Deploy an EDR agent that only alerts on post-execution behaviors such as PowerShell spawning from Office.

Set all finance workstations to automatically install Windows updates every night.

GIAC Security Essentials

Domain 4Objective 2

Endpoint Security GSEC Practice Questions (Page 4)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 16–20

16expert · hard
An EDR solution alerts on a workstation that is running a known vulnerable version of a remote access tool. The tool is used by IT for remote support. The vendor has released a patch, but applying it requires a reboot that would disrupt ongoing remote support sessions. What is the best course of action?
Select an answer first
17expert · hard
A company is deploying a new endpoint security tool that requires local administrator privileges to install. The security team is concerned about the principle of least privilege. Which approach best balances the need to install the tool with the principle of least privilege?
Select an answer first
18application · medium
A company is deploying new laptops to a sales team that travels frequently. The laptops will store customer data. The security team wants to ensure data is protected if a laptop is lost or stolen. Which control is most important?
Select an answer first
19foundation · easy
Which capability is typically provided by an Endpoint Detection and Response (EDR) solution?
Select an answer first
20application · medium
A company's finance team frequently receives targeted phishing emails with malicious Office documents. The endpoint security team wants to reduce the risk of macro-based malware executing on Windows workstations while minimizing disruption to legitimate document workflows. Which configuration best addresses this risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Endpoint Security GSEC Practice Questions (Page 4)

Questions 16–20

A company is deploying a new endpoint security tool that requires local administrator privileges to install. The security team is concerned about the principle of least privilege. Which approach best balances the need to install the tool with the principle of least privilege?

A company is deploying new laptops to a sales team that travels frequently. The laptops will store customer data. The security team wants to ensure data is protected if a laptop is lost or stolen. Which control is most important?

Which capability is typically provided by an Endpoint Detection and Response (EDR) solution?

Keep studying — Endpoint and Platform Security