A security team wants to detect attempts to disable endpoint protection software. Which logging configuration is most likely to provide early warning?

Enable PowerShell script block logging

Audit for changes to services and security software

Enable Windows Firewall logging

Which endpoint protection technology uses signature-based detection to identify known malware by matching file hashes or code patterns?

Host-based intrusion detection system (HIDS)

An organization is deploying a new endpoint hardening policy. The policy must balance security with user productivity. Users frequently need to install software and customize system settings. Which approach best meets both requirements?

Grant all users local administrator rights to avoid help desk tickets.

Implement a software deployment tool that installs approved software with administrative privileges while users run with standard rights.

Disable all software installation and require IT to manually install every application.

Use Group Policy to allow users to install any software without prompts.

A company's security team is configuring new Windows 10 workstations for employees who need to install approved software but should not be able to change system settings. The team wants to minimize the risk of malware execution while maintaining user productivity. Which configuration approach best meets these requirements?

Grant users local administrator rights and rely on antivirus to detect malicious files.

Disable Windows Defender and use a third-party firewall only.

Enable Windows Defender Application Guard for all applications.

Run users with standard user privileges and use Application Control to allow only approved executables.

A security team is selecting an endpoint protection solution for a mixed environment of Windows and Linux servers. The solution must provide real-time threat detection, automated response actions, and centralized visibility. Which type of solution best fits these requirements?

Traditional antivirus with signature updates.

Host-based intrusion prevention system (HIPS).

File integrity monitoring (FIM) tool.

Endpoint Detection and Response (EDR) platform.

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 8)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 36–40

36application · medium
A security team wants to detect attempts to disable endpoint protection software. Which logging configuration is most likely to provide early warning?
Select an answer first
37foundation · easy
Which endpoint protection technology uses signature-based detection to identify known malware by matching file hashes or code patterns?
Select an answer first
38expert · hard
An organization is deploying a new endpoint hardening policy. The policy must balance security with user productivity. Users frequently need to install software and customize system settings. Which approach best meets both requirements?
Select an answer first
39application · medium
A company's security team is configuring new Windows 10 workstations for employees who need to install approved software but should not be able to change system settings. The team wants to minimize the risk of malware execution while maintaining user productivity. Which configuration approach best meets these requirements?
Select an answer first
40application · medium
A security team is selecting an endpoint protection solution for a mixed environment of Windows and Linux servers. The solution must provide real-time threat detection, automated response actions, and centralized visibility. Which type of solution best fits these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.