7.2 - Implement and Operate Endpoint Device Security SSCP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's sales team uses a web-based CRM system. The security team wants to ensure that all communications with the CRM are encrypted and that the CRM's certificate is valid. They also want to block access if the certificate is expired or self-signed. Which control should be implemented on the endpoints?

   • AUse a host-based firewall to allow only port 443
   • BConfigure the browser to enforce HTTPS and validate certificates
   • CDeploy EDR to detect malicious web traffic
   • DUse a VPN for all internet traffic
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm has a fleet of Windows 10 workstations used by tellers. The security team wants to prevent unauthorized executables from running, especially those delivered via phishing emails. They also need to ensure that legitimate business applications, including a custom in-house teller application, continue to function without interruption. Which control should be implemented as the primary defense?

   • AEnable a host-based firewall with default-deny outbound rules
   • BConfigure EDR to quarantine any file with a low reputation score
   • CDeploy a HIPS with a policy that blocks unknown processes from spawning
   • DImplement application whitelisting that allows only approved executables to run
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A manufacturing company has a set of industrial control system (ICS) workstations that run a specific SCADA application. The security team wants to ensure that only the SCADA application and its associated utilities can run on these workstations, and any other executable should be blocked. They also want to prevent the SCADA application from being modified by malware. Which control should be implemented?

   • AEDR with application control
   • BApplication whitelisting with hash-based rules
   • CHost-based firewall with application rules
   • DHIPS with a policy to block unknown processes
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which action is typically performed by a host-based firewall?

   • AAllowing or denying traffic to and from the host based on security rules
   • BMonitoring system calls and blocking malicious behavior on the host
   • CEncrypting the host's hard drive to protect data at rest
   • DGenerating alerts for suspicious activity without taking action
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of full disk encryption on an endpoint device?

   • ATo monitor a host for suspicious activity and generate alerts
   • BTo protect data at rest by encrypting the entire storage device
   • CTo allow only approved software to run on the device
   • DTo filter incoming and outgoing traffic based on security rules
   Reveal Solution Discussion Select an answer first