Examkin

Question

Difficulty: HardWorkstation Hardening and Best Practices

An IT security technician is updating baseline security policies for workstations deployed across an enterprise network. Match each workstation hardening control on the left with the specific risk or attack vector it is primarily designed to mitigate on the right.

  • Restricting 'Allow log on locally' rights via Local Group PolicyPrevents non-authorized user accounts from establishing interactive physical console sessions.
  • Enforcing screensaver timeout with password protectionPrevents unauthorized physical access to an active desktop session when left unattended.
  • Disabling the built-in Guest account and renaming the default Administrator accountMitigates automated dictionary attacks and default credential harvesting targeting standard accounts.
  • Disabling AutoPlay and AutoRun policies across all storage volumesPrevents automatic execution of untrusted payloads when removable media is inserted.

Answer

Restricting local logon rights matches with preventing non-authorized user accounts from establishing interactive physical console sessions. Enforcing screensaver timeout with password protection matches with preventing unauthorized physical access to an active desktop session when left unattended. Disabling the built-in Guest account and renaming the Administrator account matches with mitigating automated dictionary attacks targeting standard accounts. Disabling AutoPlay and AutoRun policies matches with preventing automatic execution of untrusted payloads when removable media is inserted.
Each workstation hardening control addresses a specific vulnerability vector. Restricting local logon permissions prevents unauthorized accounts from initiating physical console sessions. Password-protected screen locks prevent physical exposure of unattended active sessions. Disabling or renaming built-in accounts thwarts automated credential guessing against default account identifiers. Disabling AutoPlay/AutoRun stops drive-by code execution from connected removable storage.

Step-by-Step Solution

1
Analyze local user rights policies for interactive logon control.
Determined that 'Allow log on locally' controls physical console logon capability.
Restricting this permission ensures that only authorized personnel can log into the local workstation console.
2
Evaluate inactivity screen locking mechanisms.
Identified that password-protected screen saver timeouts lock active sessions automatically.
When a technician or user steps away, the lock prevents passerby tampering and shoulder surfing.
3
Examine account obfuscation and disabling policies.
Identified that default accounts like Guest and Administrator are predictable targets.
Renaming or disabling default accounts blocks automated scripts relying on standard account names.
4
Assess removable media execution controls.
Determined that AutoPlay/AutoRun policies govern media file auto-execution.
Disabling these features stops rogue USB flash drives or external drives from launching malicious code automatically.

Key Concept

Workstation Hardening and Threat Mitigation Controls
Estimated Time:2m 0s
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic