How does an EDR solution primarily support threat detection beyond traditional antivirus?

By analyzing behavioral patterns and correlating events across endpoints

By blocking all network traffic by default

By requiring users to change passwords frequently

By scanning email attachments in the cloud

A company allows employees to use personal laptops for remote work. The security team wants to enforce a minimum security baseline on these devices before they can access corporate email. Which approach best meets this requirement?

Implement a conditional access policy that checks device compliance before allowing email access

Deploy an EDR agent to each personal laptop and rely on its detection capabilities

Ask users to confirm they have antivirus installed via an annual survey

Require the laptops to be domain-joined and apply Group Policy settings

Which attack vector involves an attacker exploiting a vulnerability in software that is exposed to the internet on an endpoint?

Unpatched software vulnerability

Which statement best describes the role of endpoint defense within a security operations center (SOC)?

It is the primary mechanism for enforcing network segmentation policies

It focuses exclusively on preventing malware infections on user workstations

It provides visibility and control over endpoint devices to support threat detection, investigation, and response

It is responsible for managing user identities and access permissions on endpoints

Which practice is essential for an effective endpoint monitoring strategy?

Centralizing and correlating logs from multiple endpoints

Storing logs only on each individual endpoint

Reviewing logs only after a security incident is reported

Disabling logging for routine events to reduce noise

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 7)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 31–35

31foundation · easy
How does an EDR solution primarily support threat detection beyond traditional antivirus?
Select an answer first
32application · medium
A company allows employees to use personal laptops for remote work. The security team wants to enforce a minimum security baseline on these devices before they can access corporate email. Which approach best meets this requirement?
Select an answer first
33foundation · easy
Which attack vector involves an attacker exploiting a vulnerability in software that is exposed to the internet on an endpoint?
Select an answer first
34foundation · easy
Which statement best describes the role of endpoint defense within a security operations center (SOC)?
Select an answer first
35foundation · easy
Which practice is essential for an effective endpoint monitoring strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.