Hardening Techniques

Question 1 of 6

A security analyst discovers that a workstation was compromised by a novel ransomware variant with no existing antivirus signature. The ransomware was delivered via a phishing email attachment: the user opened a Word document containing a macro, which spawned PowerShell, which downloaded and executed the ransomware payload. Which endpoint security technology would have been MOST likely to detect and block this attack despite the absence of an antivirus signature?

A host-based firewall configured to block all outbound PowerShell connections. EDR using behavioral analysis — detecting the suspicious process chain (Word spawning PowerShell, which made an external connection and executed a downloaded binary) as a high-risk attack pattern regardless of the payload's signature. An updated antivirus signature database downloaded that morning — signatures updated frequently enough will catch novel variants. A network-based IPS that scans all inbound email attachments for malicious content before delivery to the endpoint.

Question 2 of 6

An organization's penetration tester successfully logs into a network router's management interface on the first attempt without any prior reconnaissance of the specific device's credentials. Which hardening failure MOST directly enabled this access?

The organization did not deploy full disk encryption on the router, allowing the tester to read stored credentials from the device's flash memory. The router was still configured with its factory default credentials — the tester looked up the default username and password for that router model in publicly available vendor documentation. The router's management interface was accessible over HTTP instead of HTTPS, allowing the tester to capture credentials transmitted in cleartext. The organization did not deploy an EDR agent on the router, preventing detection of the login attempt.

Question 3 of 6

During a hardening assessment, a security engineer uses Nmap to scan a production database server and discovers that port 23 (Telnet) and port 21 (FTP) are open in addition to the expected port 1433 (SQL Server). What is the MOST appropriate immediate remediation for these findings?

Restrict Telnet and FTP access to only IT staff by adding IP-based ACL rules that permit IT workstations on those ports. Disable and uninstall the Telnet and FTP services entirely — these plaintext protocols have no place on a production database server, and removing the services eliminates the attack surface permanently rather than restricting it. Upgrade Telnet and FTP to their encrypted equivalents (SSH and SFTP) to eliminate the plaintext transmission risk while retaining the protocols' functionality. Document the open ports as accepted risk and monitor port 23 and port 21 traffic with the SIEM for suspicious connections.

Question 4 of 6

A user's workstation is infected with malware. The malware attempts to: (1) install a kernel-mode driver for keylogging; (2) stop the endpoint detection service; (3) write files to C:\Windows\System32\. All three actions FAIL. The workstation user is configured as a standard (non-administrator) account. Which hardening control is responsible for preventing all three actions?

Full disk encryption — the encrypted volume prevented the malware from writing to protected system locations. Host-based firewall — blocked the malware's outbound connection, preventing it from receiving the commands to perform these actions. Least privilege — the standard user account lacks the administrative rights required for kernel driver installation, service modification, and writes to protected OS directories. The malware ran in the user's context and inherited the user's limited permissions. HIPS — detected the malware's attack patterns and blocked each action individually before execution.

Question 5 of 6

A vulnerability scan reveals that 200 workstations have a critical unpatched vulnerability in a version of Java that was installed 2 years ago as a dependency for a legacy application now decommissioned. No users on these workstations have any need for Java. What is the MOST appropriate hardening action?

Patch Java to the current version on all 200 workstations to remediate the known CVEs. Uninstall Java from all 200 workstations — since no users require Java, the correct hardening action is removal, which permanently eliminates the attack surface rather than requiring ongoing maintenance of software that serves no business function. Disable Java auto-update to prevent future version changes from introducing instability, and accept the current vulnerability as residual risk. Configure the host-based firewall on each workstation to block Java from making outbound network connections, compensating for the unpatched vulnerability.

Question 6 of 6

A host-based firewall provides capabilities that a network perimeter firewall cannot. Which capability is UNIQUE to host-based firewalls compared to traditional network firewalls?

Blocking inbound connections from specific external IP addresses and port ranges. Enforcing access control rules based on the specific application process generating or receiving network traffic — for example, permitting chrome.exe on port 443 while blocking an unknown process attempting to use the same port. Logging all blocked connection attempts for SIEM forwarding and forensic review. Inspecting encrypted TLS traffic by performing SSL/TLS decryption and re-encryption in the traffic path.

Matching — Hardening Concepts

1. EDR

2. HIPS

3. Nmap

4. Removal of Unnecessary Software

1. 2. 3. 4.

A. A hardening practice that permanently eliminates attack surface by uninstalling applications, OS components, and features not required for the system's function — removing the risk entirely rather than patching or restricting it

B. An endpoint security platform that detects threats using signatures, behavioral analysis, machine learning, and process monitoring; investigates through root cause analysis; and autonomously responds by isolating the system, quarantining threats, and rolling back configurations

C. A network scanning tool used during hardening assessments to discover open ports and running services on systems — the standard method for creating a port baseline, verifying post-hardening changes, and detecting new open ports in ongoing monitoring

D. A security control integrated into endpoint protection platforms that monitors OS-level activity — including memory access, registry modifications, and file system writes to protected directories — and blocks malicious actions such as buffer overflows and unauthorized kernel driver installation before they complete

Hardening Techniques Quiz

Matching — Hardening Concepts