Examkin

Question

Difficulty: Very hardWorkstation Hardening and Best Practices

Match each workstation security hardening requirement or administrative objective to the most appropriate Windows configuration control or security feature that implements it.

  • Prevent users from mounting external USB mass storage drives while continuing to allow USB mice and keyboards to functionConfigure Removable Storage Access policies in Group Policy (GPO)
  • Mitigate OS-level credential harvesting and memory scraping techniques targeting LSASS secretsEnable Windows Defender Credential Guard using Virtualization-based Security (VBS)
  • Automatically lock an unattended user workstation when a paired mobile device leaves the immediate physical areaEnable Dynamic Lock under Sign-in options
  • Prevent unauthenticated code execution triggered automatically upon inserting optical or flash mediaDisable AutoPlay and AutoRun policies across all drives via Administrative Templates

Answer

The hardening requirements map directly to their corresponding controls: prohibiting USB mass storage while retaining human interface devices corresponds to configuring Removable Storage Access policies in GPO; protecting LSASS from memory scraping corresponds to enabling Credential Guard with VBS; automatically locking an unattended desktop via Bluetooth proximity corresponds to Dynamic Lock; and disabling automated code launch from inserted media corresponds to disabling AutoPlay and AutoRun policies.
Each security requirement aligns with its specific technical implementation. Denying USB storage access while preserving keyboards/mice relies on GPO Removable Storage Access restrictions. Protecting LSASS memory from administrative privilege abuse requires Credential Guard with VBS. Proximity-based session locking uses Bluetooth Dynamic Lock. Preventing automatic binary launch on volume mount is accomplished by disabling AutoPlay and AutoRun.

Step-by-Step Solution

1
Analyze USB mass storage blocking requirements vs peripheral functionality
Disabling device driver installation entirely would break mice and keyboards. Removable Storage Access GPOs target specific device classes, denying storage access while leaving HIDs operational.
Granular policy enforcement allows administrators to restrict removable storage without impairing standard USB input peripherals.
2
Analyze LSASS memory protection techniques
Standard access control lists do not stop elevated processes from reading LSASS memory. Credential Guard employs Virtualization-based Security (VBS) to isolate LSASS tokens outside the standard OS kernel.
VBS isolates secrets in a hardware-secured environment, rendering memory scraping tools ineffective even when running with administrative rights.
3
Evaluate automated physical walk-away locking options
Dynamic Lock uses paired Bluetooth device RSSI signal attenuation to detect user absence and trigger a lock command.
This provides defense-in-depth for physical security when users fail to manually lock their desktops.
4
Evaluate automatic media execution controls
Disabling AutoPlay and AutoRun globally stops automatic parsing and launching of scripts or binaries embedded in newly inserted media.
AutoRun and AutoPlay policies directly govern automatic file handler triggers upon drive volume mounting.

Key Concept

Workstation Hardening and Best Practices
Estimated Time:3m 0s
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic