4.3 Identify and Describe Endpoint Security Components (e.g., Security Updates, Antivirus, Host-Based Firewalls) CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A user reports that their endpoint is running slowly and showing pop-up ads. The IT team suspects malware. The antivirus software has not detected anything during a full scan. Which step should the IT team take next?

   • AReinstall the operating system immediately.
   • BIgnore the issue because the antivirus scan found nothing.
   • CDisable the host-based firewall to allow the antivirus to work more effectively.
   • DUpdate the antivirus software and its virus definitions, then run another full scan.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is investigating a potential data exfiltration. The host-based firewall logs show that an endpoint made outbound connections to an unusual IP address on port 443. The antivirus software has not detected any malware. Which conclusion is most appropriate?

   • AThe connection could be legitimate, but it warrants further investigation.
   • BThe antivirus software should be updated and a full scan performed.
   • CThe host-based firewall should be configured to block all outbound traffic.
   • DThe endpoint is definitely compromised and data is being exfiltrated.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's IT team is planning a maintenance window to apply security updates to all endpoints. They want to minimize the risk of a patch causing system instability. Which approach should they take?

   • ADeploy the updates to all endpoints simultaneously to save time.
   • BTest the updates on a small group of representative endpoints before deploying to all.
   • CSkip the updates to avoid any risk of instability.
   • DOnly install critical updates and ignore all others.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is investigating a suspicious file on an endpoint. The antivirus software has not flagged it, but the analyst suspects it is malware. Which additional endpoint security component could provide information about the file's network behavior?

   • AOperating system event logs
   • BHost-based firewall logs
   • CAntivirus scan logs
   • DSecurity update history
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's IT team discovers that a known vulnerability in a widely used office productivity suite is being exploited in the wild. The vendor has released an emergency fix that addresses the flaw. The team wants to protect all endpoints as quickly as possible while minimizing disruption. Which action should the team take first?

   • ADeploy the emergency fix to all endpoints immediately.
   • BDisable the affected software on all endpoints until the next patch cycle.
   • CWait for the next scheduled monthly patch cycle to deploy the fix.
   • DUpdate antivirus definitions and rely on them to block the exploit.
   Reveal Solution Discussion Select an answer first