Examkin

Question

Difficulty: HardWorkstation Hardening and Best Practices

An IT security technician is hardening several standalone Windows 11 workstations located in a hospital's semi-public reception lobby. The endpoints are utilized by floating medical staff to access check-in systems. According to the organization's security baseline, the technician must satisfy three core security controls:
1. Prevent unauthorized code from automatically running when removable storage devices are inserted, without disabling necessary USB hardware peripherals.
2. Ensure idle sessions automatically lock to protect patient data while maintaining active background processing for logged-in sessions.
3. Reduce exposure to targeted brute-force attacks against default built-in system accounts.

Which combination of administrative configurations best satisfies all three hardening requirements?

  1. Disable AutoPlay and AutoRun policies via Group Policy, set a password-protected screensaver lock timeout, disable the local Guest account, and rename the built-in Administrator account.Answer
  2. B
    Enable the built-in Guest account with restricted local privileges for floating staff, set system sleep timeout to 5 minutes of inactivity, and disable all USB Host Controllers in Device Manager.
  3. C
    Configure Task Scheduler to run a forced user logoff script after 5 minutes of idle time, maintain default account names with complex passwords, and disable the USB Storage Service in Computer Management.
  4. D
    Attach physical monitor privacy screens, install physical USB port blockout caps, and set display power-off timeout to 5 minutes without requiring logon credentials on resume.

Answer

Disabling AutoPlay and AutoRun policies, configuring a password-protected screen saver timeout, disabling the local Guest account, and renaming the local Administrator account best meets all specified hardening controls.
The correct configuration combines logical Group Policy settings (disabling AutoPlay and AutoRun to prevent unauthorized software execution from removable drives), account security best practices (disabling the Guest account and renaming the default Administrator account to frustrate automated brute-force attempts), and session security (enforcing a password-protected screensaver lock that secures the terminal without killing background user applications).

Step-by-Step Solution

1
Address Requirement 1 (Preventing automatic execution of code from USB media without blocking peripherals)
Disabling AutoPlay and AutoRun in Group Policy stops Windows from automatically executing launcher scripts or programs upon mounting removable drives, while leaving USB controller drivers enabled for essential peripherals like keyboards and scanners.
Disabling hardware drivers entirely prevents essential input devices from functioning, whereas policy-based AutoPlay disabling addresses media execution threats specifically.
2
Address Requirement 2 (Securing idle sessions while keeping background processes running)
Configuring a screen saver lock timeout with 'On resume, display logon screen' locks the graphical display and requires password authentication, while keeping user processes actively running in the background.
Power sleep states or forced user logoff scripts either suspend operational system processes or terminate active work sessions, causing unnecessary operational disruption.
3
Address Requirement 3 (Mitigating targeted credential attacks on default accounts)
Disabling the Guest account and renaming the default Administrator account eliminates well-known default Security Identifiers (SIDs) and account names commonly targeted by automated brute-force tools.
Keeping default account names active—even with complex passwords—leaves the system vulnerable to account enumeration and targeted credential attacks.

Key Concept

Workstation Hardening Baselines and Attack Surface Reduction
Estimated Time:2m 0s
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic