Endpoint Security

Question 1 of 6

A company wants to verify that every device meets specific security requirements (current OS patches, active antivirus, enabled host firewall) before allowing it to connect to the internal network. Devices that fail the check are redirected to a quarantine VLAN. Which security control performs this function?

Endpoint Detection and Response (EDR) — it monitors endpoint behavior in real time and quarantines devices that show malicious activity Network Access Control (NAC) posture assessment — it evaluates endpoint health against a defined policy before granting network access and places non-compliant devices in a quarantine VLAN Host-based IPS — it inspects traffic destined for each device and blocks connections to non-compliant systems User Behavior Analytics (UBA) — it establishes behavioral baselines and flags devices that deviate from normal usage patterns

Question 2 of 6

An organization needs to assess the security posture of contractor laptops when they connect to guest Wi-Fi. The contractors cannot install permanent software, and the assessment should disappear after the session ends. Which NAC agent type BEST fits this requirement?

Persistent agent — permanently installed on each contractor device, receiving ongoing policy updates from the NAC server Agentless NAC — uses Active Directory integration to verify device health without installing any software on the endpoint Dissolvable agent — downloaded and executed at login time without installation; self-terminates and leaves no persistent software on the device after the session ends EDR agent — installs a lightweight behavioral monitoring agent that can be removed remotely when the contractor session is complete

Question 3 of 6

A security analyst investigates an alert showing that a Microsoft Word process (winword.exe) spawned a command shell (cmd.exe), which then connected to an external IP address and downloaded a file. Traditional antivirus did not flag anything because the malware binary was new. Which technology detected this attack, and how?

Signature-based antivirus — it matched the downloaded file’s hash against a database of known malware signatures before the file executed Network-based IPS — it analyzed the network traffic pattern and blocked the external connection based on a known bad IP reputation list Endpoint Detection and Response (EDR) — it detected the suspicious parent-child process relationship (Word spawning cmd.exe) using behavioral analysis and machine learning, identifying malicious behavior without requiring a prior signature File Integrity Monitoring (FIM) — it detected that the downloaded file modified a protected system directory and triggered an alert

Question 4 of 6

A security team uses an EDR platform and discovers that ransomware has encrypted files on a workstation. The EDR automatically quarantines the workstation from the network and reverses the file encryption by restoring files to their pre-attack state. Which EDR capability allowed the files to be restored?

Root cause analysis — it reconstructed the full attack chain and identified which files were encrypted, allowing manual restoration by IT staff Machine learning — the ML model predicted which files would be targeted by ransomware and placed them in a protected backup location before the attack began Automated rollback — the EDR agent uses Windows Volume Shadow Copy or similar snapshot technology to restore files to their known-good state before the ransomware made changes API-driven response — the EDR called the cloud backup API to restore the encrypted files from the most recent off-site backup

Question 5 of 6

A security platform aggregates telemetry from endpoint agents, network traffic sensors, cloud workload logs, and identity provider authentication records. When a user account logs in from an unusual location, then immediately accesses a large number of files on a file server, and then uploads data to an external cloud service, the platform correlates these events across all three domains and generates a single high-priority alert. Which technology is this?

EDR (Endpoint Detection and Response) — it monitors all endpoint activity and correlates events within the single device where the user is logged in SIEM — it collects logs from multiple sources, applies correlation rules, and generates alerts when conditions in the rules are met XDR (Extended Detection and Response) — it unifies telemetry from endpoints, network, cloud, and identity into a single detection platform, correlating cross-domain activity into a unified threat story NAC posture assessment — it evaluates account activity against the device health baseline before allowing access to internal resources

Question 6 of 6

A security system detects that a user account that normally works Monday through Friday, 8 AM to 6 PM, and accesses only project management files, is suddenly authenticated at 2 AM on a Sunday and is downloading large volumes of data from a database the user never accesses. No specific firewall rule or antivirus signature was triggered. Which technology would BEST detect this anomaly?

Signature-based IDS — it matches known attack patterns; a large download at unusual hours is a well-known attack signature File Integrity Monitoring — it detects changes to the database files being accessed and generates an alert when the access pattern changes User Behavior Analytics (UBA) — it establishes a baseline of normal activity for each account and generates anomaly alerts when current behavior significantly deviates from that baseline EDR behavioral analysis — it monitors process activity on the user’s workstation and detects that a new process is responsible for the database access

Matching

Match each description to the correct endpoint security technology.

1. A NAC agent type that is downloaded and executed at login time without installation and removes itself from the device when the session ends, leaving no persistent software behind

2. An EDR capability that reconstructs the complete sequence of events from initial compromise through all subsequent attacker actions, showing exactly which processes ran and what changes were made

3. A security platform that extends endpoint detection by aggregating telemetry from network sensors, cloud workloads, and identity providers into a unified detection view

4. A security analytics system that baselines normal account and user activity over time and generates alerts when current behavior significantly deviates from the established normal

1. 2. 3. 4.

A. Dissolvable agent

B. Root cause analysis

C. XDR

D. User Behavior Analytics (UBA)

Endpoint Security — Quiz

Matching