Lobby information kiosks need stronger endpoint hardening beyond signature AV alone. Which pair of controls best matches common host-hardening mitigations?
Select an answer to reveal the explanation.
Short Explanation
Kiosks sitting in the lobby need their own seatbelts. A host firewall plus HIPS watches what runs and what talks—even when the big perimeter firewall is looking the other way.
Full Explanation
Host-based firewalls restrict which networks and ports a kiosk may use, while host intrusion prevention (HIPS) can block malicious behaviors that signature AV alone misses. Lobby information kiosks sit in semi-public space with higher physical and network abuse potential, so layered host hardening beyond AV is appropriate. Together, firewall plus HIPS reduce both lateral reach and on-box exploit freedom for municipal public-facing endpoints.
Disabling the host firewall and relying only on the perimeter edge assumes every threat comes from outside the building and ignores local VLAN abuse or compromised neighbors. Removing HIPS so images boot a few seconds faster trades meaningful behavior blocking for trivial startup gain. Allowing unrestricted lateral SMB from every kiosk VLAN invites kiosk compromise to become a pivot into clerk file shares.
Exam caveat: host firewall and HIPS appear as standard endpoint hardening paired controls; perimeter-only thinking is a recurring wrong answer. Kiosks and public terminals are frequent exam settings for hardened, least-function hosts.
Operational check: enforce host firewall defaults-deny with minimal allow rules, enable HIPS in prevent mode after tuning, disable unused kiosk services, place kiosks on isolated VLANs without SMB to finance/records, and monitor HIPS/firewall alerts for repeated tampering in the lobby.