A company wants to reduce the risk of malware spreading via USB drives. Which endpoint policy is the most effective?

Encrypt all USB drives with BitLocker To Go

Disable autorun and restrict USB device access to approved devices only

Require users to scan USB drives with antivirus before use

In the context of security operations, what is the primary purpose of endpoint defense?

To protect individual devices such as laptops, servers, and mobile devices from threats and to detect and respond to security incidents on those devices

To replace the need for network security by securing every device at the host level

To ensure that all endpoints have the latest operating system updates installed

To monitor and secure only the servers that host critical applications

A security analyst notices repeated failed logon attempts followed by a successful logon on a single workstation at 3:00 AM. The EDR console shows a PowerShell process that downloaded a script from a file-sharing site and then executed it. The analyst needs to determine the scope of the activity. Which EDR capability is most directly suited to this task?

Isolation of the affected workstation from the network

Process tree visualization showing parent-child relationships

Search across all endpoints for the same script hash and related indicators

Real-time alerting rule that triggers on PowerShell execution

During incident response, an analyst finds that an attacker has been using a legitimate remote management tool to move laterally within the network. The tool is widely used by IT staff. The analyst needs to detect further malicious use of the tool without disrupting legitimate IT operations. Which approach is most effective?

Block the remote management tool entirely.

Disable all remote management accounts.

Require two-factor authentication for the tool.

Create detections for anomalous usage patterns of the tool, such as off-hours access or unusual source/destination pairs.

An endpoint is confirmed to be infected with ransomware. The incident response team needs to preserve evidence while preventing further spread. Which action should be taken FIRST?

Reimage the endpoint from a known-good image

Run a full antivirus scan on the endpoint

Power off the endpoint immediately

Isolate the endpoint from the network while keeping it powered on

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 10)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 46–50

46application · medium
A company wants to reduce the risk of malware spreading via USB drives. Which endpoint policy is the most effective?
Select an answer first
47foundation · easy
In the context of security operations, what is the primary purpose of endpoint defense?
Select an answer first
48application · medium
A security analyst notices repeated failed logon attempts followed by a successful logon on a single workstation at 3:00 AM. The EDR console shows a PowerShell process that downloaded a script from a file-sharing site and then executed it. The analyst needs to determine the scope of the activity. Which EDR capability is most directly suited to this task?
Select an answer first
49expert · hard
During incident response, an analyst finds that an attacker has been using a legitimate remote management tool to move laterally within the network. The tool is widely used by IT staff. The analyst needs to detect further malicious use of the tool without disrupting legitimate IT operations. Which approach is most effective?
Select an answer first
50application · medium
An endpoint is confirmed to be infected with ransomware. The incident response team needs to preserve evidence while preventing further spread. Which action should be taken FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Endpoint Defense GSOC Practice Questions (Page 10)

Questions 46–50

A company wants to reduce the risk of malware spreading via USB drives. Which endpoint policy is the most effective?

In the context of security operations, what is the primary purpose of endpoint defense?

An endpoint is confirmed to be infected with ransomware. The incident response team needs to preserve evidence while preventing further spread. Which action should be taken FIRST?

Keep studying — Security Operations Fundamentals