Endpoint and Host Security
Endpoint and Host Security
This domain tests hardening and detection on servers, workstations, and mobile devices. Expect questions on baseline configuration, patching, endpoint detection and response (EDR), application control, disk encryption, secure boot, host firewalls, and endpoint compliance.
Core rules
- Hardening follows a documented baseline such as CIS Benchmarks: remove unnecessary services, disable default accounts, restrict local admin, enable logging, and enforce secure configuration.
- Patch operating systems and third-party applications on a risk-based cadence. Vulnerabilities in browsers, Java, and productivity suites are routinely exploited.
- Signature-based antivirus is necessary but insufficient; fileless attacks abuse PowerShell, WMI, macros, and living-off-the-land binaries. EDR adds behavior analytics, memory inspection, and response actions such as host isolation.
- Application allowlisting permits only approved executables and scripts, which blocks many ransomware payloads.
- Full-disk encryption protects data at rest on lost devices. Secure boot and measured boot help detect bootkit tampering.
- MDM/UEM enforces encryption, screen lock, patch level, and jailbreak/root detection for mobile endpoints.
Worked example
A user opens a document that spawns PowerShell with an encoded command, which downloads a payload into memory. Signature antivirus sees no malicious file. EDR correlates the parent-child process chain (WINWORD.EXE to powershell.exe), the encoded command, and outbound beaconing, then isolates the host and collects memory. The reasoning: detection must focus on behavior and lineage, not only file hashes, and containment must preserve volatile evidence.
Traps
- Patching only the OS while ignoring browsers and productivity plugins.
- Granting permanent local administrator rights for convenience.
- Assuming EDR replaces hardening; it detects and responds but does not remove misconfigurations.