A company has a mix of Windows 10 and Windows 11 endpoints. The security team wants to enforce a consistent hardening baseline but must accommodate legacy applications that require local admin rights on a small set of machines. Which approach is most effective?

Grant local admin rights to all users on the legacy application machines

Upgrade all legacy applications to modern versions

Apply a standard security baseline to all endpoints and use application whitelisting to allow only approved legacy apps to run with elevated privileges

Exclude the legacy application machines from all security policies

What is the primary purpose of enabling detailed logging on endpoints?

To provide an audit trail for security investigations and incident response

To reduce the amount of storage space used on the endpoint

To automatically block malicious processes

To improve the endpoint's processing speed

During an incident, an analyst needs to prove that a specific file was executed on a Windows endpoint. Which log source would provide the most reliable evidence of program execution?

Windows Security Event Log with audit process creation enabled

DNS query logs from the corporate DNS server

An organization wants to protect endpoints from zero-day malware that has not yet been signatured. Which technology is most effective for this purpose?

Host firewall with default-deny outbound rules

Patch management to ensure all software is up to date

Signature-based antivirus with daily updates

Behavioral analysis that monitors process actions and flags anomalies

Which configuration change is a recommended endpoint hardening practice to limit the impact of a compromised user account?

Disabling the firewall to improve performance

Granting all users local administrator rights for convenience

Sharing the administrator password among IT staff

Using the principle of least privilege for user accounts

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 9)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 41–45

41expert · hard
A company has a mix of Windows 10 and Windows 11 endpoints. The security team wants to enforce a consistent hardening baseline but must accommodate legacy applications that require local admin rights on a small set of machines. Which approach is most effective?
Select an answer first
42foundation · easy
What is the primary purpose of enabling detailed logging on endpoints?
Select an answer first
43application · medium
During an incident, an analyst needs to prove that a specific file was executed on a Windows endpoint. Which log source would provide the most reliable evidence of program execution?
Select an answer first
44application · medium
An organization wants to protect endpoints from zero-day malware that has not yet been signatured. Which technology is most effective for this purpose?
Select an answer first
45foundation · easy
Which configuration change is a recommended endpoint hardening practice to limit the impact of a compromised user account?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.