Host, Endpoint and Application Security
Host, endpoint and application security covers the configuration, patching and code-level controls that keep workloads trustworthy after network controls have allowed the traffic through. The exam tests hardening baselines, endpoint detection, secure development practice, and whether you can describe a durable fix for a common flaw rather than simply naming it.
Host and endpoint controls
- Build from a hardened baseline (CIS Benchmarks, vendor STIGs): remove unnecessary services, change defaults, enforce least functionality.
- Patch management is a risk-based pipeline: inventory, test, deploy, verify, with severity-based SLAs that put internet-facing critical flaws first.
- EDR watches process behaviour rather than signatures alone and enables containment. Application allowlisting blocks unapproved binaries and is a strong ransomware control.
- Secure boot and measured boot establish a root of trust; full-disk encryption protects data at rest if a device is lost.
Secure development
- Threat model the design; validate input on the server; encode output for its context; parameterise queries; centralise authentication and authorisation checks.
- SAST scans source, DAST probes a running application, SCA finds vulnerable dependencies, and secrets scanning catches credentials committed to repositories.
- Shift left but verify right: pre-commit checks and runtime controls such as WAF or RASP cover different failure modes.
- Containers need minimal base images, non-root users, read-only filesystems, signed images and no embedded secrets.
Worked example
A search page concatenates user input into a SQL query. A WAF rule blocks quote characters, but an attacker encodes the payload and bypasses it. The durable fix is parameterised queries so input cannot alter query structure, plus a least-privilege database account so a successful injection cannot read other schemas. The WAF stays as defence in depth and as a detection source, but it is not the fix.
Traps
- Relying on client-side validation or hidden fields for security.
- Treating signature antivirus as equivalent to behavioural EDR.
- Patching without verifying deployment, so the vulnerable version silently returns.
- Assuming container immutability without rebuilding and rescanning images.