Endpoint Defense GSOC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst needs to detect when a user logs into an endpoint outside of normal business hours. Which log source and condition should be used?

   • AWindows Application log, Event ID 1000 (application error)
   • BWindows System log, Event ID 6005 (event log service started)
   • CWindows Setup log
   • DWindows Security log, Event ID 4624 (successful logon), filtered for logon hour outside the baseline
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An EDR alert shows that a process on a server is making outbound connections to a known malicious IP. The process is a legitimate application that is used for remote administration. The analyst suspects the application has been compromised. Which action should the analyst take to confirm the compromise?

   • ACompare the process's command-line arguments and loaded modules against a known-good baseline.
   • BRestart the application and monitor for further alerts.
   • CDisable the application's network access.
   • DBlock the malicious IP at the firewall.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which capability is a defining feature of Endpoint Detection and Response (EDR) solutions?

   • AProviding a virtual private network (VPN) for remote access
   • BReplacing the need for network monitoring tools
   • CContinuous collection of endpoint telemetry and the ability to investigate and respond to threats
   • DAutomatically patching all software vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an incident response, an analyst discovers that an attacker used a valid user's credentials to access a file server and exfiltrate data. The analyst has isolated the affected endpoint and collected memory and disk images. What should the analyst do next to prevent further unauthorized access?

   • ARun a full antivirus scan on the file server.
   • BReset the compromised user's password and revoke active sessions.
   • CDisable the file server's network interface.
   • DDelete the user's account from Active Directory.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is hardening its Windows endpoints. Which configuration change is the most effective in reducing the attack surface for credential theft?

   • AEnable BitLocker on all drives
   • BDisable LLMNR and NetBIOS name resolution
   • CSet the firewall to block all inbound connections
   • DEnable Windows Defender Credential Guard
   Reveal Solution Discussion Select an answer first