Examkin

Question

Difficulty: MediumWorkstation Hardening and Best Practices

An IT technician is configuring public-facing check-in terminals in a healthcare facility lobby. The terminals run Windows 11 and use a restricted local user account. The technician needs to prevent unauthorized software from automatically executing whenever a visitor connects an external flash drive to one of the terminals. Which of the following configurations best achieves this hardening goal?

  1. Disable AutoPlay and AutoRun features using Local Group Policy.Answer
  2. B
    Set the screen lock timeout setting to 15 minutes in the Power Control Panel applet.
  3. C
    Configure Event Viewer to create a task that logs USB insertion events.
  4. D
    Set User Account Control (UAC) to Never Notify to restrict background program prompts.

Answer

Disable AutoPlay and AutoRun features using Local Group Policy.
Disabling AutoPlay and AutoRun via Group Policy prevents Windows from executing launch scripts or applications stored on removable drives when inserted. This effectively mitigates unauthorized drive-by code execution on public terminals.

Step-by-Step Solution

1
Identify the primary threat vector described in the scenario.
The threat is the automatic execution of untrusted code or scripts from newly attached USB flash drives.
When removable media is connected, default Windows settings may attempt to execute setup scripts or trigger AutoPlay actions.
2
Evaluate operating system hardening controls specific to removable media.
Disabling AutoPlay and AutoRun via policy restricts the operating system from reading autorun.inf files or launching default media actions automatically.
Hardening workstation policies against AutoPlay/AutoRun prevents untrusted programs on USB devices from compromising the system upon connection.

Key Concept

Workstation Hardening via Disabling AutoPlay and AutoRun Policies
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic