Examkin

Question

Difficulty: MediumWorkstation Hardening and Best Practices

An IT security analyst is defining baseline workstation security standards to protect enterprise desktops against common attack vectors. Match each workstation security hardening control on the left with its corresponding risk mitigation objective on the right.

  • Disabling NetBIOS over TCP/IPBlocks LLMNR and NBT-NS network spoofing and broadcast eavesdropping attacks
  • Implementing Local Administrator Password Solution (LAPS)Mitigates lateral movement techniques that exploit reused local administrator credentials
  • Enforcing Application Allowlisting (AppLocker)Prevents execution of untrusted or unauthorized binaries and installer scripts
  • Configuring Screensaver Lock TimeoutPrevents unauthorized local session access when a device is left unattended

Answer

Disabling NetBIOS over TCP/IP matches with blocking LLMNR/NBT-NS spoofing; Implementing LAPS matches with mitigating lateral movement from reused local admin credentials; Enforcing Application Allowlisting matches with preventing execution of untrusted binaries; Configuring Screensaver Lock Timeout matches with preventing unauthorized session access to unattended devices.
Each security control targets a specific workstation vulnerability: disabling NetBIOS prevents broadcast name resolution spoofing; LAPS prevents credential reuse and lateral movement; AppLocker restricts binary execution to trusted software; screensaver timeout protects open physical sessions on idle machines.

Step-by-Step Solution

1
Analyze the purpose of network protocol hardening controls
Disabling NetBIOS over TCP/IP eliminates unauthenticated broadcast name resolution traffic, neutralizing NBT-NS/LLMNR spoofing vectors.
Legacy protocols broadcast requests across the local subnet, which malicious actors on the segment can easily intercept.
2
Analyze local account privilege management solutions
LAPS ensures unique, randomized passwords for local administrator accounts on every endpoint.
If local administrator passwords are standard across machines, compromising one system leads to lateral movement across the entire network.
3
Analyze software execution restriction policies
AppLocker enforce allowlisting rules to block unauthorized executables, installers, and scripts.
Allowlisting operates on a default-deny principle, blocking malware or unauthorized software even if the user attempts to launch it.
4
Analyze physical and environmental workstation controls
Screensaver lock policies require user re-authentication after a set interval of system inactivity.
This control mitigates physical security risks when users leave their desks unattended without manually locking their operating system.

Key Concept

Workstation Hardening and Risk Mitigation
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic