5.6 Identify and Describe Cybersecurity Threats Mitigated by the Following Endpoint Security Technologies CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which threat is patch management specifically designed to mitigate?

   • AExploitation of known vulnerabilities in software
   • BData exfiltration via removable media
   • CUnauthorized access to the network
   • DMalicious system calls from compromised processes
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A sales representative's laptop, which contains confidential client proposals, is stolen from a coffee shop. The laptop was protected by a BIOS password, but the hard drive was not encrypted. What is the primary risk to the confidential data in this scenario?

   • AThe data is safe because the laptop is protected by a device control policy
   • BThe BIOS password will prevent the laptop from booting, so the data is safe
   • CAn attacker can remove the hard drive and access the data directly from another system
   • DThe laptop's host-based firewall will block unauthorized access to the data
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst notices that a legitimate system process on a server is behaving abnormally, making unauthorized changes to critical system files and spawning child processes that are not part of its normal operation. The analyst suspects a sophisticated attack that has evaded signature-based detection. Which endpoint security technology is best suited to detect and block this behavior?

   • AHost-based Intrusion Prevention System (HIPS) that monitors process behavior and system call activity
   • BDisk encryption policy that encrypts the system files to prevent modification
   • CHost-based firewall that blocks all outbound traffic from the server
   • DApplication Control policy that denies the legitimate system process from running
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user's laptop is infected with malware that attempts to communicate with a command-and-control server over the internet and also tries to modify system files to maintain persistence. The security team wants to stop the malicious network communication immediately while a full investigation is conducted. Which endpoint security technology should be used to address this immediate need?

   • AApplication Control policy that denies the malware executable from running
   • BHIPS policy that blocks the malware process from modifying system files
   • CHost-based firewall rule that blocks outbound traffic to the known command-and-control IP address
   • DDisk encryption policy that encrypts the system files to prevent modification
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a legacy application that is critical to its operations but is no longer supported by the vendor, so no security patches are available. The application has known vulnerabilities that could be exploited. The security team needs to mitigate the risk while keeping the application running. Which combination of controls is most effective?

   • AUse Device Control to block all USB devices on the endpoints running the application
   • BEnable disk encryption on the endpoints running the application
   • CApply a host-based firewall rule to block all inbound traffic to the application
   • DUse Application Control to allow the application only on specific endpoints and HIPS to monitor its behavior for anomalies
   Reveal Solution Discussion Select an answer first