What is the primary function of application control as an endpoint protection technology?

To monitor network traffic for suspicious patterns

To automatically update software to the latest version

To allow or block the execution of specific applications on the endpoint

To encrypt data stored on the endpoint's hard drive

A company's security team notices that several endpoints are beaconing to a known command-and-control domain. The team has an EDR solution deployed. Which EDR capability is most directly useful to confirm the scope of the compromise and identify the initial access vector?

Review the process tree and network connections recorded for each affected endpoint.

Apply a host-based firewall rule to block the command-and-control domain.

Reimage all affected endpoints from a known-good image.

Run a full antivirus scan on all endpoints to detect the malware signature.

A company's workstations are infected with ransomware that encrypts files and displays a ransom note. The antivirus software did not detect the ransomware. Which additional control would have been most likely to prevent the infection?

Application control that blocks unauthorized executables from running.

A backup solution that stores data offsite.

A network firewall that blocks all inbound traffic.

Which endpoint hardening practice involves regularly applying updates to operating systems and applications to fix known vulnerabilities?

Endpoint detection and response (EDR)

A user receives a phone call from someone claiming to be IT support, asking for their password to 'fix a problem.' The user provides the password. Later, the user's account is used to access sensitive files. Which type of attack occurred?

Social engineering via phone (vishing)

GIAC Security Essentials

Domain 4Objective 2

Endpoint Security GSEC Practice Questions (Page 8)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 36–40

36foundation · easy
What is the primary function of application control as an endpoint protection technology?
Select an answer first
37application · medium
A company's security team notices that several endpoints are beaconing to a known command-and-control domain. The team has an EDR solution deployed. Which EDR capability is most directly useful to confirm the scope of the compromise and identify the initial access vector?
Select an answer first
38application · medium
A company's workstations are infected with ransomware that encrypts files and displays a ransom note. The antivirus software did not detect the ransomware. Which additional control would have been most likely to prevent the infection?
Select an answer first
39foundation · easy
Which endpoint hardening practice involves regularly applying updates to operating systems and applications to fix known vulnerabilities?
Select an answer first
40application · easy
A user receives a phone call from someone claiming to be IT support, asking for their password to 'fix a problem.' The user provides the password. Later, the user's account is used to access sensitive files. Which type of attack occurred?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.