CCIS: Endpoint and Systems Security

Domain 4: Endpoint and Systems Security

This domain tests hardening and protecting hosts and workloads: baselines, patching, endpoint detection and response, application control, host firewalls, disk encryption, secure boot, logging, and container or serverless hardening. The exam favors controls that reduce attack surface and detect compromise, not just malware signatures.

Core rules and concepts

• Build from a hardened baseline: remove unnecessary services and accounts, disable legacy protocols, enforce host firewall rules, and manage local administrators. Revalidate images continuously; a golden image decays.
• Patch by risk: internet-facing and remotely exploitable flaws first; track operating system, application, firmware, and container base images. Compensating controls apply only when patching is genuinely blocked.
• EDR collects endpoint telemetry and can isolate a host. It complements antivirus; it does not replace patching, least privilege, or application control.
• Application control allows known-good software and blocks the rest. It is stronger than blocklisting for unmanaged endpoints.
• Disk encryption protects data at rest if the device is lost; it does not protect a running, unlocked session. Secure boot and measured boot help detect boot-level tampering.
• Centralize logs and protect them from local deletion. Time synchronization matters for correlation.

Worked example

A workstation shows a suspicious PowerShell process spawning from an Office document. EDR alerts, and the analyst isolates the host from the network but keeps management connectivity. The team collects memory and disk evidence, identifies the parent process and user, resets the user's credentials and revokes sessions, then hunts for the same command line on other hosts. Reasoning: isolation limits spread; evidence preservation supports scoping; credential reset addresses possible theft. Deleting the file first would destroy evidence; reimaging immediately could erase the scope of compromise.

Traps that cost marks

Do not equate EDR with antivirus. Do not patch only the operating system and ignore browsers, firmware, and container images. Do not give users permanent local admin for convenience. Do not disable logging to improve performance. Do not assume encryption protects data on a powered-on unlocked laptop.