Endpoint Defense GSOC Practice Questions (Page 11)

Questions 51–53

1. 51expert · hard

   A security analyst is responding to a suspected endpoint compromise. The EDR shows a process running from a user-writable folder, and the process has an invalid digital signature. The analyst must preserve evidence for potential legal action. The endpoint is a critical server that cannot be taken offline for more than a few minutes. Which approach best balances evidence preservation and operational continuity?

   • APerform a live memory acquisition, then isolate the server from the network but keep it running
   • BCopy the executable file to a forensic workstation and then delete it from the server
   • CPower off the server immediately and image the hard drive
   • DKill the suspicious process and continue monitoring
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which action is part of the containment phase of endpoint incident response?

   • ADeleting malicious files from the endpoint
   • BIsolating the affected endpoint from the network
   • CConducting a root cause analysis
   • DRestoring the endpoint from a backup
   Reveal Solution Discussion Select an answer first
3. 53expert · hard

   A security team is designing an endpoint logging strategy. They need to detect lateral movement using remote PowerShell (WinRM) and also detect use of stolen credentials. They have limited storage and must prioritize logs. Which logging configuration is the most effective for these detections?

   • AEnable PowerShell script block logging and audit logon events on all endpoints
   • BEnable only process creation auditing
   • CEnable only Windows Defender Firewall logs
   • DEnable only file system auditing
   Reveal Solution Discussion Select an answer first