Domain 5: Endpoint Defense

GIAC Certified Enterprise Defender · 13 questions

• A Windows endpoint begins executing PowerShell commands that download a second-stage payload, spawn a new process, and inject code into a legitimate svchost.exe process. Which EDR capability is MOST critical for detecting this fileless attack chain?
• A hardening team is configuring a Windows server to minimize attack surface against credential theft. Which combination of settings BEST reduces exposure?
• An organization implements application whitelisting on endpoints. Users report that legitimate business applications are being blocked. What is the MOST effective approach to managing exceptions while maintaining security?
• A security engineer finds that 30% of workstations have not received critical OS patches after 60 days. The patches address an RCE vulnerability actively exploited in the wild. What is the BEST immediate remediation approach?
• An attacker bypasses endpoint antivirus using a signed Microsoft Office macro to download a PowerShell payload that runs entirely in memory. Which endpoint defense capability MOST effectively detects this attack?
• A security team discovers employees are using personal USB drives to transfer files to and from corporate laptops in violation of policy. Which endpoint control BEST technically enforces the USB restriction?
• An organization wants to enforce secure configurations consistently across 5,000 endpoints. Which approach MOST effectively ensures consistent hardening at scale?
• A Windows endpoint protection team wants to prevent macro execution in Microsoft Office documents delivered via email. Which combination of controls provides defense in depth for this threat?
• An EDR console shows a process tree: winword.exe → cmd.exe → powershell.exe -enc [base64 string] → net.exe user /add backdoor P@ssw0rd. Which MITRE ATT&CK techniques are represented, and what immediate action should be taken?
• An organization wants to implement application whitelisting on workstations to prevent unauthorized software execution. A user complains that a legitimate business tool installed in their user profile (C:\Users\jdoe\AppData\Local\) is being blocked. What is the correct whitelisting policy adjustment?
• A patch management audit reveals that 15% of Windows workstations have not received the most recent security patches in 90 days. The primary reason is that these machines are used for 24/7 operations and cannot be rebooted. Which approach best balances security and operational continuity?
• A security engineer is hardening a Windows Server 2022 system. Which CIS Benchmark recommendation has the highest impact on reducing the attack surface for a web server role?
• An EDR alert shows a legitimate antivirus process (avgnt.exe) loading an unsigned DLL from C:\Temp\msdetour.dll. What attack technique does this most likely represent?