Examkin

Question

Difficulty: HardWorkstation Hardening and Best Practices

A systems administrator is establishing a comprehensive security baseline across enterprise endpoints. Match each workstation hardening control on the left with the specific threat or vulnerability it directly mitigates on the right.

  • Disabling the Remote Registry service and restricting inbound TCP port 445 via local firewall rulesPrevents unauthorized remote system tampering, network registry modification, and SMB-based lateral movement
  • Enforcing a mandatory screen saver lock requiring user password re-authentication after five minutes of idle timePrevents unauthorized physical access, walk-up intrusion, and active session hijacking on unattended endpoints
  • Renaming the built-in local Administrator account and disabling the default Guest accountMitigates automated credential spraying and dictionary attacks targeting well-known default local accounts
  • Configuring Group Policy to disable AutoRun and AutoPlay features for all removable storage mediaBlocks the automatic execution of untrusted code or scripts when malicious external drives are attached

Answer

Disabling Remote Registry and blocking SMB port 445 prevents unauthorized remote tampering and SMB-based lateral movement. Enforcing screen saver locks mitigates unauthorized physical access on unattended endpoints. Renaming default admin accounts and disabling guest accounts mitigates automated credential spraying against standard account names. Disabling AutoRun/AutoPlay blocks automatic malicious script execution from plugged-in storage media.
Each workstation hardening measure targets a specific attack surface: restricting Remote Registry and SMB port 445 neutralizes remote management exploitation; enforcing idle screen locks secures physical access in shared office environments; disabling default accounts neutralizes automated brute-force attacks against predictable local usernames; disabling AutoRun prevents untrusted execution of external scripts from connected peripherals.

Step-by-Step Solution

1
Analyze network hardening controls
Disabling Remote Registry and closing TCP port 445 blocks network-based registry access and SMB exploitation.
Port 445 and Remote Registry are primary vectors for remote network probing and lateral movement.
2
Evaluate physical security enforcement controls
Enforcing a timed screen lock protects idle active sessions from walk-up unauthorized users.
Unattended unlocked workstations expose sensitive data to local physical threats.
3
Assess default user account security practices
Altering default account names thwarts automated dictionary attacks targeting standard account SIDs.
Default accounts like Administrator and Guest are known targets for automated brute-forcing.
4
Examine removable storage policy restrictions
Disabling AutoRun/AutoPlay stops drive-by code execution upon insertion of USB devices.
AutoRun automatically processes setup scripts on newly attached media unless explicitly restricted by policy.

Key Concept

Workstation Hardening and Attack Surface Reduction Controls
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic