An organization is deploying new laptops with Windows 10. The security team wants to ensure that the devices can verify their integrity at boot and that encryption keys are protected by hardware. They also want to prevent unauthorized changes to the boot process. Which technology should they enable?

Full disk encryption (FDE) with a software-based key

A university research lab has a set of Linux workstations used for scientific computing. The security team wants to monitor these systems for suspicious activity, such as unusual file access patterns or privilege escalation attempts, but they do not want to interfere with the researchers' work by blocking any actions. Which control should they implement?

Host-based intrusion detection system (HIDS)

Host-based firewall with logging

Host-based intrusion prevention system (HIPS)

Endpoint detection and response (EDR)

A company's security policy requires that workstations only allow outbound connections to specific approved services (e.g., email, web, and internal applications). The IT team wants to enforce this at the endpoint level and also log any blocked attempts for auditing. Which control should be configured?

Application whitelisting to restrict which applications can access the network

EDR with network threat detection

HIPS with a policy to block malicious outbound connections

Host-based firewall with allow-list rules for outbound traffic

A small business has a single server that hosts a critical application. The server has been targeted by malware that attempts to modify system files and make unauthorized outbound connections. The business wants to actively block such malicious activities on the host, not just receive alerts. Which control should be deployed?

Host-based intrusion detection system (HIDS)

Endpoint detection and response (EDR)

Host-based intrusion prevention system (HIPS)

Host-based firewall with default-deny rules

What is the primary purpose of application whitelisting on an endpoint?

To filter network traffic based on security rules

To encrypt data at rest on the endpoint

To monitor a host for suspicious activity and generate alerts

To allow only approved software to run, preventing unauthorized executables

Systems Security Certified Practitioner

Domain 7Objective 2

7.2 - Implement and Operate Endpoint Device Security SSCP Practice Questions (Page 5)

Part of the Systems and Application Security domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

15%of the exam

Questions 21–25

21application · medium
An organization is deploying new laptops with Windows 10. The security team wants to ensure that the devices can verify their integrity at boot and that encryption keys are protected by hardware. They also want to prevent unauthorized changes to the boot process. Which technology should they enable?
Select an answer first
22application · medium
A university research lab has a set of Linux workstations used for scientific computing. The security team wants to monitor these systems for suspicious activity, such as unusual file access patterns or privilege escalation attempts, but they do not want to interfere with the researchers' work by blocking any actions. Which control should they implement?
Select an answer first
23application · medium
A company's security policy requires that workstations only allow outbound connections to specific approved services (e.g., email, web, and internal applications). The IT team wants to enforce this at the endpoint level and also log any blocked attempts for auditing. Which control should be configured?
Select an answer first
24application · medium
A small business has a single server that hosts a critical application. The server has been targeted by malware that attempts to modify system files and make unauthorized outbound connections. The business wants to actively block such malicious activities on the host, not just receive alerts. Which control should be deployed?
Select an answer first
25foundation · easy
What is the primary purpose of application whitelisting on an endpoint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

7.2 - Implement and Operate Endpoint Device Security SSCP Practice Questions (Page 5)

Questions 21–25

What is the primary purpose of application whitelisting on an endpoint?

Keep studying — Systems and Application Security