Endpoint Security Concepts: Hardening, Malware Families, and Host Controls
Endpoints are where data lives and where most incidents start, so this domain tests whether you can pick the control that addresses a root cause rather than a symptom.
Malware families
A virus needs a host file and usually user action; a worm self-propagates across networks without a host program; a trojan disguises itself as legitimate software; ransomware encrypts or exfiltrates data and demands payment; a rootkit hides at kernel or firmware level; spyware and keyloggers steal data and credentials; a logic bomb triggers on a condition or date; fileless malware lives in memory and abuses legitimate tools like PowerShell. Naming the family correctly is a frequent question type.
Host controls
Antivirus matches signatures; EDR watches behavior and can isolate a host. HIPS blocks suspicious host activity; a host firewall filters traffic per application or port. Patching removes known vulnerabilities. Application allowlisting (default deny, permit known-good) is stronger than blocklisting. Full-disk encryption with a TPM protects data at rest if a device is lost. Secure Boot and UEFI validation block bootkits. Running users as standard (non-admin) accounts blocks most privilege escalation and silent installs. MDM/UEM manages mobile and BYOD devices, often with containerization that separates work from personal data. DLP watches for sensitive data leaving the endpoint.
Traps
'Antivirus catches everything' - signature-based tools miss zero-days, fileless attacks, and heavily obfuscated malware. 'Encryption prevents data theft' - it protects a stolen laptop's disk, not data taken by malware running as the logged-in user. Blocklisting feels productive but allowlisting is the control that actually shrinks attack surface.
Rule of thumb
Layer patch management, least privilege, allowlisting, disk encryption, and monitoring. When two answers both seem plausible, choose the one that removes the underlying weakness - patching a vulnerable service beats alerting on its exploitation.