Free Hardening and Endpoint Controls practice questions

A secure baseline is the documented, tested configuration that every new system is built to and every running system is measured against, and CIS Benchmarks are a common starting point. A host firewall, a patching schedule and disk encryption are all settings a baseline might require, but none of them is the standard itself or a way to measure drift.

GPOs are processed in the order local, site, domain, OU, and on a conflict the last one applied wins, so the OU's 5-minute setting overrides the domain's 15. The domain value would win only if its link were marked Enforced, which the scenario rules out. Precedence doesn't depend on when a GPO was edited, and the local setting is the first applied, so it loses to both.

Password settings for domain accounts take effect only from a GPO linked at the domain level; linked to an OU they affect only local accounts, so a stricter rule for one group needs a fine-grained password policy. Enforced changes precedence, not that scope. gpresult already shows the GPO applied, so neither a forced refresh nor a change to security filtering addresses the cause.

When a GPO is configured but a machine isn't following it, gpresult is the first check, because it shows which GPOs applied and which were filtered out and why. The usual causes are a computer in an unexpected OU, security filtering that excludes it or a conflicting GPO that wins, and a forced refresh or a reinstall fixes none of them. Relinking at the domain with Enforced changes every computer before the cause is even known.

When a confined service needs an optional behavior, SELinux provides a boolean, and httpd_can_network_connect lets Apache open outbound connections; -P makes the change persistent. restorecon fixes wrong file labels, which isn't the cause when the denial is a network connection. setenforce 0 or a permissive config line would make the error disappear only by removing mandatory access control from every service on the server.

When a device can't be hardened enough because it can't run an agent and is rarely patched, the compensating control is isolating it on its own segment so a compromise can't spread. MDM enrollment, an application allow list and a HIDS agent all depend on running software on the device, which these readers can't do.

Mass renaming and random-looking file contents are the classic ransomware pattern, and behavior-based detection judges code by what it does, so it can catch a strain nobody has described yet. Signatures and hash block lists recognize only samples that have already been identified, and a host firewall filters network connections, not file activity.

EDR continuously records network connections, process starts and other activity and keeps that telemetry for weeks or months, which is what lets analysts hunt for endpoints that contacted a newly learned indicator. Antivirus quarantine logs record detections, not every connection, and a HIPS or next-generation antivirus is built to detect or block activity as it happens, not to keep a month of searchable history.

A HIPS watches activity on its own host, including local logons, protected registry keys and process behavior, and can block it, such as stopping one process from writing into another's memory. A HIDS sees the same activity but only alerts, and a network-based IPS never sees actions that don't cross the network. Signature antivirus matches known malicious files rather than blocking these actions.

Traffic between hosts on the same subnet never passes through the network firewall, so the control has to sit on each device; host firewalls blocking inbound TCP 445 from peers closed the path WannaCry used to spread. A HIDS would only alert, and antivirus updates may help detection but don't close the network path between peers.