Examkin

Question

Difficulty: MediumWorkstation Hardening and Best Practices

A security technician is developing an image baseline for mobile laptops used by traveling consultants. To protect systems against local privilege escalation and automated malware execution from untrusted removable drives, which TWO workstation hardening measures should the technician enforce?

  1. Disable AutoPlay and AutoRun functionality for removable storage media.Answer
  2. B
    Grant local administrator rights to the built-in Guest account to isolate user activity.
  3. Disable or rename the built-in local Administrator account.Answer
  4. D
    Configure Event Viewer to block incoming network connections on unused ports.

Answer

Disabling AutoPlay and AutoRun functionality for removable storage media, and disabling or renaming the built-in local Administrator account.
Hardening a workstation image requires closing high-risk entry points and securing default accounts. Disabling AutoPlay and AutoRun prevents malicious scripts on connected USB drives from automatically executing. Disabling or renaming the built-in local Administrator account prevents malicious actors from leveraging standardized, well-known usernames for brute-force attacks or privilege escalation.

Step-by-Step Solution

1
Identify potential attack vectors related to external storage devices.
Disabling AutoPlay/AutoRun prevents untrusted executables from launching automatically when a USB device is inserted.
Automated code execution from external drives is a primary malware vector for mobile devices.
2
Identify local account hardening best practices.
Disabling or renaming default system accounts (such as the built-in Administrator) removes well-known targets for brute-force attack attempts.
Attackers target known default usernames to escalate privileges locally.

Key Concept

Workstation Hardening Controls
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic