Endpoint and System Security
Domain 4 - Endpoint and System Security
This domain covers hardening, patching, endpoint detection and response, application control, and protecting servers and workstations. Questions test baseline configuration and response actions.
Core rules
- Start from a hardened baseline: remove unnecessary services, disable default accounts, enforce least functionality, and log security events. Enforce baselines with configuration management, not manual checklists.
- Patch by risk, not by convenience. Prioritize internet-facing and actively exploited vulnerabilities.
- Application allowlisting blocks unapproved executables and is stronger than blocklisting known bad hashes.
- EDR collects behavioral telemetry and can isolate a host, kill a process, and query fleet-wide indicators. Antivirus signatures alone miss fileless and living-off-the-land attacks.
- Full-disk encryption protects data at rest if a device is lost; it does not stop a logged-in attacker.
Worked example
EDR flags a workstation encrypting many files and deleting shadow copies. Isolate the host from the network, preserve volatile memory and logs, reset credentials used on the host, block observed indicators, and restore from a validated backup. Do not immediately power off, because memory evidence and encryption keys may be lost.
Traps
Believing patching fixes misconfiguration; relying on signatures only; wiping an infected host before collecting evidence; and assuming disk encryption prevents data theft by malware running as the user.