4.3 Identify and Describe Endpoint Security Components (e.g., Security Updates, Antivirus, Host-Based Firewalls) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A user's endpoint is infected with malware that attempts to communicate with a command-and-control server over the internet. The host-based firewall on the endpoint is configured with a default-deny policy for outbound traffic. What is the most likely outcome?

   • AThe firewall logs the traffic but allows it because it is outbound.
   • BThe malware is automatically removed by the firewall.
   • CThe malware's outbound connection is blocked, preventing it from receiving commands.
   • DThe firewall blocks the malware from running.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's endpoints are infected with ransomware that encrypts files. The antivirus software detected and removed the ransomware, but the files remain encrypted. The company has backups, but they are from two weeks ago. The IT team is considering whether to restore from backups or attempt to decrypt the files. Which factor is most important in this decision?

   • AThe number of security updates installed on the endpoints.
   • BThe age of the backups and the amount of data that would be lost.
   • CThe host-based firewall's configuration.
   • DThe antivirus software's ability to prevent future infections.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which technique does antivirus software primarily use to detect known malware by comparing files against a database of malware signatures?

   • AHeuristic analysis
   • BSignature-based detection
   • CBehavioral monitoring
   • DSandboxing
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary function of a host-based firewall on an endpoint?

   • ATo manage user authentication
   • BTo filter network traffic to and from the endpoint
   • CTo scan files for malware
   • DTo encrypt data stored on the endpoint
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A company's security policy requires that endpoints only allow network connections to specific internal servers and block all other inbound traffic. Which endpoint security component should be configured to enforce this policy?

   • AHost-based firewall
   • BSecurity updates
   • CIntrusion prevention system (IPS)
   • DAntivirus software
   Reveal Solution Discussion Select an answer first