Endpoint and System Security
What this domain tests
Endpoint and System Security tests how hosts are hardened, monitored, and contained. Expect questions on patching, configuration baselines, antivirus versus EDR, application allowlisting, disk encryption, secure boot, and container or mobile endpoints.
Core rules
- Hardening reduces attack surface: remove unused services, disable default accounts, enforce least privilege, and apply a documented baseline such as a CIS Benchmark.
- Patch management should prioritize internet-facing and actively exploited vulnerabilities, with rollback and testing built in.
- Signature-based antivirus matches known patterns; EDR records process, file, network, and identity behavior and supports response actions such as isolation.
- Application allowlisting permits only approved executables and is a strong defense against unknown malware, but it requires maintenance.
- Full-disk encryption protects data at rest if a device is lost; Secure Boot verifies boot components against trusted signatures.
Worked example
Ransomware encrypts a finance workstation. EDR shows an unsigned executable launched from a user's download folder, then spawned PowerShell to disable backups. Response: isolate the host, preserve volatile evidence, reset credentials, block the hash, and restore from a known-good backup. Prevention: allowlisting, macro blocking, least privilege, and tested offline backups.
Traps that cost marks
- Equating EDR with antivirus; EDR is behavior-focused and supports investigation.
- Assuming patching removes the need for detection and response.
- Forgetting that encryption at rest does not protect a running, unlocked session.
- Treating container images as immutable without scanning and signing them.