Examkin

Question

Difficulty: HardWorkstation Hardening and Best Practices

A security analyst is auditing endpoint hardening configurations for shared customer service desktops. Corporate policy requires that inactive user sessions automatically lock after five minutes without terminating running applications, and that unauthenticated users cannot access local resources via legacy default accounts. Which of the following configurations best satisfies both requirements?

  1. Enable a password-protected screen saver with a 5-minute wait time and ensure the local Guest account is disabled.Answer
  2. B
    Set the display power-off timer to 5 minutes and modify local user account rights using Event Viewer.
  3. C
    Configure a 5-minute system sleep timer using Credential Manager and add the local Guest account to the local Administrators group.
  4. D
    Install physical monitor privacy filters and leave the built-in Guest account enabled with a blank password for quick station switching.

Answer

Enabling a password-protected screen saver set to a 5-minute timeout while disabling the built-in local Guest account.
The correct choice configures a password-protected screen saver set to trigger after 5 minutes of inactivity, which locks the active session while retaining unsaved work in open applications. Additionally, disabling the built-in local Guest account follows security best practices by eliminating an unneeded account that could otherwise be targeted for unauthorized access.

Step-by-Step Solution

1
Identify session locking mechanism
Determined that a password-protected screen saver or interactive logon lock screen timeout locks the session after inactivity without closing applications.
Turning off the monitor or putting the system to sleep without enforcing screen lock leaves open sessions accessible upon wake or power-on.
2
Evaluate local account hardening requirements
Verified that built-in default accounts, specifically the local Guest account, must be disabled.
Leaving default accounts active creates potential attack vectors for unauthorized local or network authentication.
3
Select administrative tool and policy configuration
Selected Local Security Policy / Computer Management tools to verify account status and configured screen lock settings.
Event Viewer and Credential Manager are not suitable snap-ins for local account management or display timeout configuration.

Key Concept

Workstation Hardening and Account Security Controls
Estimated Time:1m 30s
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic