Examkin

Question

Difficulty: Very hardWorkstation Hardening and Best Practices

A systems administrator is configuring local security policies on a shared Windows workstation deployed in an unmonitored kiosk area. The system must allow users to interact with a web portal while preventing automatic execution of untrusted scripts from inserted removable media, mitigating credential harvesting through legacy name resolution fallback protocols, and minimizing the overall local attack surface. Which of the following sets of hardening measures best achieves these security objectives?

  1. Disable LLMNR and NBT-NS protocols, enforce Group Policy settings to disable AutoRun and AutoPlay across all drives, apply AppLocker or Software Restriction Policies, and disable the built-in Guest and local Administrator accounts.Answer
  2. B
    Set User Account Control to Never Notify to prevent interactive login prompts, enable the built-in Guest account for seamless user access, and rely on System Restore points to rollback unauthorized changes.
  3. C
    Open Event Viewer to stop unnecessary background system services, disable outbound HTTPS traffic on port 443, and enable Telnet on port 23 for administrative remote troubleshooting.
  4. D
    Attach privacy screens to the monitor, install security cables to the desk, and rely exclusively on network Share permissions while removing local NTFS file system permissions.

Answer

Disabling LLMNR/NBT-NS protocols, enforcing Group Policy to disable AutoRun and AutoPlay across all drives, applying Software Restriction Policies or AppLocker, and disabling default local accounts represents the optimal combination of workstation hardening controls.
The correct response combines essential operating system hardening controls: turning off legacy resolution protocols (LLMNR/NBT-NS) prevents network credential interception, disabling AutoRun/AutoPlay stops untrusted media from automatically executing payloads, enforcing AppLocker/SRP ensures only approved applications can run, and disabling built-in accounts minimizes local entry points.

Step-by-Step Solution

1
Analyze the technical requirements of the scenario.
Identified key requirements: mitigate script execution from USB drives, prevent legacy protocol poisoning, prevent unauthorized execution, and reduce local account vulnerability.
Hardening requires selecting controls that directly map to identified threat vectors.
2
Evaluate protocol-level and service-level hardening measures.
Disabling LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) mitigates local network spoofing and hash-harvesting attacks.
Legacy fallback protocols broadcast requests in cleartext and are frequently exploited by attackers on local segments.
3
Evaluate media auto-execution and application execution control measures.
Disabling AutoRun/AutoPlay via Group Policy stops payload delivery upon drive insertion, while AppLocker restricts binary execution to authorized paths and hashes.
Default OS behaviors often allow automatic content indexing or execution from external mass storage devices.
4
Evaluate account hardening policies.
Disabling built-in Guest and local Administrator accounts restricts privilege escalation pathways.
Default accounts have well-known SID patterns and provide prime targets for brute-force attacks.

Key Concept

Workstation Hardening and Defense-in-Depth Configuration
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic