Examkin

Question

Difficulty: HardWorkstation Hardening and Best Practices

A technician is implementing security baselines on standalone Windows 11 computers deployed in a sensitive research facility. To harden the workstations against unauthorized network name spoofing and lateral movement attempts without interfering with required administrative tasks, the technician must turn off vulnerable legacy broadcast protocols and shut down unused background operating system services. Which of the following security actions best accomplishes these hardening goals?

  1. Disable Link-Local Multicast Name Resolution (LLMNR) via Local Group Policy and stop/disable the Remote Registry service.Answer
  2. B
    Add all standard local user accounts to the Backup Operators group and set User Account Control (UAC) to Never Notify.
  3. C
    Configure a User Data Collector Set within Performance Monitor to log and block incoming NetBIOS broadcast requests in real time.
  4. D
    Adjust settings in Credential Manager to force hardware privacy filters whenever incoming network connections are initiated.

Answer

The technician should disable Link-Local Multicast Name Resolution (LLMNR) via Local Group Policy and stop/disable the Remote Registry service.
Disabling Link-Local Multicast Name Resolution (LLMNR) prevents fall-back broadcast name resolution spoofing attacks, and disabling the Remote Registry service stops unauthorized users from reading or altering registry keys remotely. Together, these steps effectively reduce the network attack surface on standalone workstations.

Step-by-Step Solution

1
Identify key attack vectors associated with legacy network resolution and unnecessary system services.
Recognize that LLMNR uses unauthenticated network broadcasts that attackers can spoof to capture credential hashes, while the Remote Registry service exposes registry modifications over the network.
Hardening requires reducing the system attack surface by turning off unneeded protocols and services.
2
Select the appropriate administrative controls to disable these components on standalone Windows endpoints.
Use Local Group Policy Editor (gpedit.msc) to disable turn off multicast name resolution, and Services (services.msc) to set Remote Registry startup type to Disabled.
This directly mitigates network spoofing and unauthorized remote registry access without restricting authorized local administrative management.

Key Concept

Workstation Service and Protocol Hardening
Estimated Time:2m 0s
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic