5.6 Identify and Describe Cybersecurity Threats Mitigated by the Following Endpoint Security Technologies CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a server that is running a custom in-house application. The application is critical to operations and cannot be stopped. The analyst notices that the application is making unexpected system calls and writing to files outside its designated directory. The behavior is not matched by any known signature. The analyst wants to block this malicious behavior without disrupting the application's normal functions. Which approach is most appropriate?

   • ACreate an Application Control policy to deny the custom application from running
   • BImplement a host-based firewall rule to block all outbound traffic from the server
   • CEnable disk encryption on the server to prevent unauthorized file modifications
   • DConfigure a HIPS policy to monitor and block the specific anomalous system calls and file writes
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A research lab handles highly sensitive intellectual property. The lab manager is concerned about employees copying data to personal external hard drives. They want to prevent any data from being written to external storage devices while still allowing the use of USB mice and keyboards. Which control should be configured?

   • AFull-disk encryption on all lab workstations
   • BHost-based firewall rule that blocks all USB traffic
   • CApplication Control policy that denies the file explorer application
   • DDevice Control policy that blocks write access to external storage devices but allows HID devices
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary function of a host-based firewall on an endpoint?

   • ATo filter inbound and outbound network traffic based on rules applied to that specific device
   • BTo restrict the use of peripheral devices such as USB drives and external storage
   • CTo monitor and block malicious activities by analyzing system calls and process behavior
   • DTo encrypt the entire hard drive to protect data at rest
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security administrator is configuring a new endpoint for a remote worker who handles sensitive customer data. The administrator wants to ensure that the endpoint is protected against network-based attacks, data theft if the device is lost, and malicious software that might attempt to modify system files. Which set of controls should be implemented to address all three concerns?

   • AHost-based firewall, Application Control, and Device Control
   • BFull-disk encryption, Patch Management, and USB Control
   • CApplication Control, Device Control, and Patch Management
   • DHost-based firewall, full-disk encryption, and HIPS
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is troubleshooting a server that is running a web application. The server's HIPS is generating alerts about the web application process making unusual system calls and attempting to write to the system directory. The analyst is unsure if this is a false positive or a real attack. The web application is critical and cannot be stopped. What is the best course of action?

   • AConfigure a host-based firewall to block all outbound traffic from the server
   • BDisable the HIPS alerts to avoid disruption and continue monitoring
   • CImmediately create an Application Control policy to deny the web application from running
   • DInvestigate the HIPS alerts to determine if the behavior is legitimate, and if not, create a HIPS rule to block the specific malicious activity
   Reveal Solution Discussion Select an answer first