CCST Endpoint Operating System Security 2 — Questions and Answers
Question 1: What is the principle of least privilege in endpoint security?
- Users should have no access to any resources
- Users should be granted only the minimum permissions needed for their job (Correct answer)
- Administrators should have unlimited access
- All users should share one admin account
Correct answer: Users should be granted only the minimum permissions needed for their job
Least privilege means users and processes only get the minimum access needed, reducing damage from compromised accounts.
Implementation means standard accounts for daily use with elevation only when needed. On Windows: standard users with UAC. On Linux: regular users with sudo when necessary.
Question 2: Which Windows feature controls whether applications can make changes to the operating system?
- Windows Defender
- User Account Control (UAC) (Correct answer)
- BitLocker
- Windows Firewall
Correct answer: User Account Control (UAC)
UAC prompts for confirmation before allowing applications to make changes requiring elevated privileges.
UAC uses an integrity level system: processes run at medium by default, elevation raises to high. Keep UAC enabled and train users to question unexpected prompts.
Question 3: What type of software monitors endpoint activity and detects threats in real time?
- VPN client
- Endpoint Detection and Response (EDR) (Correct answer)
- DHCP server
- Load balancer
Correct answer: Endpoint Detection and Response (EDR)
EDR solutions continuously monitor endpoints, detect suspicious behavior, and provide automated response capabilities.
EDR uses behavioral analysis and machine learning beyond signature-based detection. It records detailed telemetry and can automatically isolate endpoints or kill malicious processes.
Question 4: Why is full disk encryption important for endpoint security?
- It speeds up disk operations
- It protects data if the device is lost or stolen by making it unreadable without the decryption key (Correct answer)
- It prevents malware installation
- It backs up data to the cloud
Correct answer: It protects data if the device is lost or stolen by making it unreadable without the decryption key
Full disk encryption ensures all data is unreadable without proper authentication if the device is lost or stolen.
BitLocker (Windows), FileVault (macOS), or LUKS (Linux) encrypt the entire drive. Protected by TPM and/or password. Without FDE, an attacker can remove the drive and read all data directly.
Question 5: What is the purpose of application whitelisting on endpoints?
- To speed up application loading
- To allow only pre-approved applications to execute (Correct answer)
- To automatically update applications
- To monitor application network usage
Correct answer: To allow only pre-approved applications to execute
Application whitelisting permits only approved applications to run, blocking all unauthorized software including unknown malware.
Whitelisting is more secure than blacklisting because it blocks all unauthorized code. Windows AppLocker and WDAC are built-in tools. The challenge is maintaining the whitelist as software updates.
Question 6: What is a host-based firewall and how does it differ from a network firewall?
- Filters wireless only while network firewall filters wired
- Runs on individual endpoints filtering per-device traffic while a network firewall protects the perimeter (Correct answer)
- Blocks external threats while network blocks internal
- Requires no configuration while network needs manual setup
Correct answer: Runs on individual endpoints filtering per-device traffic while a network firewall protects the perimeter
Host-based firewalls control traffic per-device; network firewalls protect the network boundary.
Host firewalls (Windows Firewall, iptables) provide per-application filtering. Both are essential for defense in depth. Host firewalls are critical when devices connect to untrusted networks.
CCST Endpoint Operating System Security 2
What is the principle of least privilege in endpoint security?