Host and Endpoint Security
Domain 3 covers protecting the device itself: servers, laptops and workstations. L1 questions present an endpoint symptom or a hardening checklist and ask for the correct control or the correct next step.
Hardening baseline
A baseline is a documented, repeatable configuration applied to every host of a class:
- Remove or disable unused services, protocols and shares; disable SMBv1 and legacy authentication.
- Rename or disable default accounts, forbid shared local administrator accounts, and give users standard rights with elevation only when needed.
- Enforce patching for operating system and third-party software, including firmware, on a defined cycle with a rollback path.
- Enable the host firewall, disk encryption backed by a TPM, screen lock with a short timeout, and UEFI Secure Boot to resist bootkits.
- Forward host logs to a central collector so a compromised machine cannot erase its own evidence.
Endpoint protection layers
Signature antivirus matches known malware and misses new samples; EDR watches behaviour (Office spawning PowerShell, mass file renaming, credential dumping) and can isolate a host remotely. Host intrusion prevention, application allow-listing and USB port control close the gaps signature tools leave. None of these replaces patching, because most ransomware enters through an unpatched edge service or a phished credential.
Worked example
A workstation runs WINWORD.EXE, which immediately spawns powershell.exe with a long encoded command that contacts an external IP. What is happening and what do you do? Reasoning: a document editor has no legitimate reason to launch a script host with encoded arguments; the parent-child relationship, not the file hash, is the signal. This is a behavioural detection, so EDR rules catch it where signature scanning may not. Response: isolate the host from the network through the console (do not power it off - memory holds the payload and the command-and-control address), preserve memory and disk images, reset the user's credentials, then reimage rather than cleaning in place. Deleting the document alone leaves persistence untouched.
Traps that cost marks
- Assuming updated antivirus equals a secure endpoint.
- Recommending daily local administrator use because it is convenient.
- Confusing firmware and OS patch cycles, or patching without testing and rollback.
- Shutting a suspect machine down and destroying volatile evidence.