Endpoint Security Management Flashcards

Question 1

What is an endpoint in the context of information security?

Accepted Answer

An endpoint is any device that connects to a network and can send or receive data, such as a laptop, smartphone, or server. Because each one can be a point of entry, attackers may target them directly. Security programs therefore give every endpoint its own controls, monitoring, and owner.

Question 2

What is an attack surface, and why does it matter for endpoints?

Accepted Answer

The attack surface is the total set of points where an unauthorized user could try to enter or extract data from a system. For endpoints, it includes open network ports, installed software, user accounts, removable media, and browser activity. Reducing that surface removes opportunities for attackers, so administrators disable unused services and remove unneeded applications.

Question 3

What is the difference between a threat, a vulnerability, and a risk?

Accepted Answer

A threat is any actor or event that could cause harm, a vulnerability is a weakness that a threat could exploit, and risk is the likelihood that harm occurs combined with its potential impact. For example, phishing is a threat and an unpatched browser is a vulnerability.

Question 4

What do the confidentiality, integrity, and availability principles mean for endpoints?

Accepted Answer

The CIA triad names three goals: confidentiality, integrity, and availability. Confidentiality means only authorized people can read stored or transmitted data. Integrity means data and settings remain accurate and unaltered, which malware often breaks. Availability means users can reach their devices and services when needed, so ransomware that locks files violates it.

Question 5

What does the principle of least privilege require for user accounts?

Accepted Answer

The principle of least privilege requires that every user, process, and application receive only the access needed to perform its assigned task. On an endpoint, this usually means standard accounts for daily work and separate administrator accounts used only when installing software or changing system settings. Limiting rights also contains malware.

Question 6

How does defense in depth protect an endpoint from a single failed control?

Accepted Answer

Defense in depth layers several independent controls so that one failure does not expose the whole system. An endpoint might combine a host firewall, encryption, application allowlisting, anti-malware software, and user training. If a phishing email gets past training, the attacker still faces the other layers before reaching sensitive data.

Question 7

What is the difference between a policy, a standard, and a procedure?

Accepted Answer

A policy is a high-level statement of management intent, such as requiring all endpoints to be encrypted. A standard sets specific, mandatory requirements that support the policy, such as approved encryption methods. A procedure is a step-by-step set of instructions that staff follow to meet the standard, such as how to enable disk encryption on a laptop.

Question 8

What are preventive, detective, and corrective security controls?

Accepted Answer

The three types are preventive, detective, and corrective controls. Preventive controls stop an incident before it happens, such as application allowlisting or disk encryption. Detective controls identify an incident in progress or after it occurs, such as log review or endpoint alerts. Corrective controls restore normal operations, such as reimaging an infected laptop.

Question 9

Why is an accurate endpoint inventory necessary before other controls can work?

Accepted Answer

An endpoint cannot be protected if the security team does not know it exists. Patches, antivirus policies, and monitoring agents all depend on a complete list of managed devices. Unknown devices, often called shadow IT, can bypass every control and become unnoticed entry points, so inventory supports every other practice.

Question 10

What information should an endpoint inventory record for each device?

Accepted Answer

A useful endpoint inventory records the device name, hardware model, operating system and version, assigned owner, physical location, installed software, and network address. It should also note the management agents installed and the time of the last successful check-in. Accurate records let teams identify affected systems quickly when a new vulnerability is announced.

Question 11

What is the difference between managed and unmanaged endpoints?

Accepted Answer

A managed endpoint is enrolled in central administration tools that can push policies, install updates, and collect telemetry. An unmanaged endpoint is outside those tools, so administrators cannot verify its configuration or patch status. Unmanaged devices include personal phones used for work and lab machines that were never enrolled.

Question 12

How does a bring your own device policy change endpoint management?

Accepted Answer

A bring your own device policy allows employees to use personal phones or laptops for work, which expands the endpoints the organization must account for. Management usually requires enrollment in a mobile device management tool and separation of work data from personal data. It should also state what is monitored.

Question 13

What is asset classification and why does it matter for endpoints?

Accepted Answer

Asset classification sorts devices by sensitivity and business importance, such as public, internal, confidential, or critical. Endpoints that store customer records or run financial systems receive stronger controls, faster patching deadlines, and closer monitoring than a shared kiosk. Classifying devices lets teams spend limited security effort where a compromise would cause the most harm.

Question 14

What is shadow IT and how can an organization find it?

Accepted Answer

Shadow IT is hardware or software used without approval from the IT department. Organizations can find it by comparing network traffic and asset records against approved lists, reviewing expense reports for unapproved purchases, and scanning for devices that appear on the network but not in the inventory.

Question 15

What is network segmentation and how does it relate to endpoints?

Accepted Answer

Network segmentation divides a network into separate zones so that traffic between them is limited and monitored. For endpoints, segmentation can place workstations, guest devices, and servers in different segments, so a compromised laptop cannot easily reach sensitive systems. Segmentation does not replace endpoint controls, but it reduces how far an intrusion can spread.

Question 16

What is the purpose of tracking endpoints across their entire lifecycle?

Accepted Answer

Its purpose is to track each device from provisioning through assignment, maintenance, reassignment, and retirement. Security checks at each stage prevent gaps, such as a retired laptop still holding data or a reassigned device keeping old accounts. Secure data wiping and removal from the inventory complete the process when hardware leaves service.

Question 17

What is a security baseline for an endpoint?

Accepted Answer

A security baseline is a documented set of approved settings that a device must have before it is trusted on the network. It typically covers account policies, service configuration, firewall rules, logging, and encryption. Baselines give teams a known starting point, so deviations are easy to detect and correct during audits and drift checks.

Question 18

What is hardening, and what does it involve?

Accepted Answer

Hardening is the process of reducing an endpoint's weaknesses by removing unnecessary features and tightening configuration. It involves disabling unused services and ports, removing unneeded software, changing default passwords, enabling host firewalls, and turning on logging. Each change shrinks the attack surface, so an attacker has fewer ways in.

Question 19

Why should default passwords and default accounts be changed or disabled?

Accepted Answer

Default credentials are widely known, often published in vendor documentation, and frequently tried by automated attacks. Leaving them in place gives an attacker an easy way in without any exploit. Administrators should assign unique, strong passwords to every account, rename or disable built-in accounts, and remove unneeded sample or guest accounts.

Question 20

How does application allowlisting differ from blocklisting on endpoints?

Accepted Answer

Application allowlisting permits only programs on an approved list to run, and everything else is denied by default. Blocklisting does the opposite, allowing everything except programs known to be harmful. Blocklisting is simpler to start but cannot stop new or unknown malware, while allowlisting is stricter and more effective against unfamiliar threats.

Question 21

What is the purpose of disk encryption on an endpoint?

Accepted Answer

Disk encryption protects stored data by making it unreadable to anyone who does not hold the decryption key. If a laptop is lost or stolen, an attacker who removes the drive cannot read the files without that key. Full-disk encryption works best with secure key storage and recovery keys kept in a controlled location.

Question 22

Why do endpoints need local logging and centralized log collection?

Accepted Answer

Endpoint logs matter because they record logons, process starts, policy changes, and security events, creating evidence investigators need. Local logging alone is unreliable because an attacker with administrator rights can delete or alter records on the device. Forwarding logs to a central collection point protects them and allows correlation across many machines.

Question 23

What is configuration drift, and how is it detected?

Accepted Answer

Configuration drift is the gradual change of a device's settings away from its approved baseline, often caused by updates, user changes, or troubleshooting. Teams detect it by scanning endpoints against the baseline and comparing results with a known-good reference. Drifted settings are then reviewed, corrected automatically where safe, or documented as approved exceptions.

Question 24

What is a golden image and why do administrators use one?

Accepted Answer

A golden image is a clean, hardened, patched template of an operating system and standard applications, used to build new devices. Using one ensures every machine starts from approved baseline, which reduces configuration errors. It also speeds recovery, since an infected endpoint can be rebuilt from the image instead of cleaned by hand.

Question 25

What is the difference between a vulnerability scan and a penetration test?

Accepted Answer

A vulnerability scan is an automated check that compares software and configuration against known weakness databases to identify likely flaws. An authorized, hands-on attempt by a tester to exploit weaknesses and show what an attacker could achieve is a penetration test. Scans are broad and repeatable, while penetration tests are deeper and slower, so mature programs use both.

Question 26

What is the purpose of a patch management cycle for endpoints?

Accepted Answer

A patch management cycle is a repeating process of identifying, testing, deploying, and verifying software updates across all endpoints. Its purpose is to close known vulnerabilities before attackers use them, while keeping systems stable. Testing catches conflicts with business applications before deployment, and verification confirms each update was installed.

Question 27

How should administrators prioritize which patches to deploy first?

Accepted Answer

Administrators should prioritize patches by combining severity, whether the flaw is being actively exploited, and how important the affected asset is. A critical flaw on an internet-facing server with known exploit activity deserves faster action than a minor issue on an isolated test machine.

Question 28

What is a zero-day vulnerability and why is it hard to defend against?

Accepted Answer

A zero-day vulnerability is a software flaw that is unknown to the vendor so no patch exists when attackers begin using it. Because no fix is available, defenders must rely on other controls, such as least privilege, application allowlisting, network segmentation, and behavioral detection. Patching still matters once a fix is released.

Question 29

What steps make up a vulnerability management program?

Accepted Answer

A vulnerability management program follows a repeating sequence: discover assets, identify weaknesses, assess and rank them by risk, remediate through patches or configuration changes, and verify that fixes worked. Each cycle feeds the next, so new findings and changes in the environment are reviewed. Reporting results to owners keeps the work accountable.

Question 30

What is a compensating control and when is one used?

Accepted Answer

A compensating control is an alternative safeguard used when a vulnerability cannot be patched in time, such as a legacy system that a vendor no longer supports. Examples include isolating the device and restricting which users can reach it. The compensating control should be documented, reviewed regularly, and removed once a real fix is applied.

Question 31

What is a remediation deadline and how should it be set?

Accepted Answer

A remediation deadline is the time limit set for fixing a vulnerability, usually based on its severity, exposure, and asset importance. Higher-risk findings on critical or internet-facing systems receive shorter deadlines than low-risk findings on isolated devices. Deadlines should be written into policy, assigned to named owners, and tracked so overdue items are escalated.

Question 32

What is a software bill of materials and why does it help?

Accepted Answer

A software bill of materials is an inventory of the components, libraries, and versions that make up an application. It helps teams determine quickly whether a newly announced vulnerability affects them, even when the software came from a third party. Without it, administrators may have to search every system by hand.

Question 33

What is endpoint detection and response, and what does it do?

Accepted Answer

Endpoint detection and response, often called EDR, is a set of tools that record endpoint activity and analyze it for attack signs. It can isolate a suspicious device from the network, collect forensic data, and support investigators in tracing how an intrusion began. EDR complements antivirus because it looks for suspicious behavior, not only known malware signatures.

Question 34

What is the purpose of an incident response plan for endpoints?

Accepted Answer

An endpoint incident response plan defines who does what when a suspected compromise occurs, from first alert to recovery. It establishes roles, communication paths, decision rules for isolating devices, and steps for preserving evidence. Practicing the plan through tabletop exercises reveals gaps before a real incident, so responders act quickly and consistently under pressure.

Question 35

What are containment, eradication, and recovery in endpoint incident handling?

Accepted Answer

The three phases are containment, eradication, and recovery. Containment limits the spread of an incident, such as isolating an infected laptop from the network. Eradication removes the attacker's access and malicious code from affected systems. Recovery restores systems to normal operation, often by rebuilding from a clean image and monitoring afterward.

Question 36

What role does user awareness training play in endpoint security?

Accepted Answer

User awareness training teaches staff to recognize phishing, unsafe downloads, and social engineering that bypass technical controls. Employees who report suspicious messages give security teams early warning, often before any alert fires. Training is not a substitute for controls, however, because well-crafted attacks can still succeed. Measuring reporting rates shows whether it works.

Question 37

What is the principle of separation of duties in endpoint governance?

Accepted Answer

Separation of duties means that no single person controls every step of a sensitive process. For endpoints, approvers and installers should be different people, and changes to security settings should be reviewed by someone other than the person who made them. This reduces the risk of fraud, error, and undetected misuse.

Question 38

Why is a documented exception process important for endpoint policies?

Accepted Answer

An exception process lets the organization approve a documented, time-limited deviation from a standard when business needs require it. Without a formal process, workarounds become permanent and invisible, and the true security posture is unknown. Each exception should record the justification, the compensating controls, the approver, and an expiration point for review.

Question 39

What metrics help leaders judge endpoint security performance?

Accepted Answer

Useful metrics include the percentage of endpoints covered by management tools, the average time to patch critical vulnerabilities, the number of open high-risk findings, and the time needed to contain confirmed incidents. Trends matter more than single snapshots because they show whether controls are improving.

Question 40

How should an organization handle a lost or stolen laptop?

Accepted Answer

The first step is to report the loss immediately so the security team can disable accounts and revoke access tokens. Next, remote wipe or lock the device if the management tool allows it, and confirm whether disk encryption was active. Then review what sensitive data the device held and assess notification duties.

Endpoint Security Management Flashcards

1Endpoint Security Fundamentals

2Inventory and Asset Visibility

3Configuration and Hardening

4Patching and Vulnerability Management

5Detection, Response, and Governance

Learning Resources