Endpoint Security GSEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company wants to prevent users from installing unauthorized software on their Windows workstations. The security team has decided to implement application control. Which approach is most effective while minimizing administrative overhead?

   • AUse a default-deny policy that allows only executables signed by trusted publishers.
   • BSet all users as standard users and rely on UAC prompts.
   • CUse a default-allow policy that blocks a list of known malicious applications.
   • DRequire users to request approval before installing any software.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is evaluating endpoint protection platforms. They need to detect fileless malware that runs in memory, and they also need to enforce application control. The team has a limited budget and wants to minimize the number of agents. Which solution is most suitable?

   • AA host intrusion prevention system (HIPS) alone.
   • BA network-based intrusion detection system (IDS).
   • CAn EDR solution that includes memory detection and application control.
   • DA traditional antivirus with a host firewall.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An EDR alert shows that a workstation ran a PowerShell script that downloaded an executable and executed it. The script was not blocked by application control because PowerShell is allowed. The security team needs to respond while minimizing business disruption. Which action is most appropriate?

   • ADelete the executable and allow the user to continue working.
   • BRebuild the workstation from a known good image immediately.
   • CIsolate the workstation and investigate the script and executable in a sandbox.
   • DDisable PowerShell on all workstations immediately.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A small business uses a mix of Windows 10 and Windows 11 laptops. The owner wants to ensure that all laptops receive security updates promptly without requiring user intervention. The laptops are not domain-joined and are used both inside and outside the office. Which solution is the most appropriate?

   • ASend an email to all employees reminding them to check for updates each week.
   • BSet up a WSUS server on the local network and point all laptops to it.
   • CEnable automatic updates in Windows Settings on each laptop individually.
   • DConfigure Windows Update for Business policies through Microsoft Intune.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization's security team suspects a laptop is compromised after an employee clicked a link in a phishing email. The EDR console shows suspicious process activity but no confirmed malware file. The incident responder needs to preserve evidence and understand the scope. Which action should be taken first?

   • ADisable the user's account and wait for the user to return the laptop.
   • BRun a full antivirus scan and delete any detected files.
   • CReboot the laptop to clear any malicious processes from memory.
   • DIsolate the laptop from the network using the EDR's isolation feature.
   Reveal Solution Discussion Select an answer first