Examkin

Soru

Zorluk: ZorWorkstation Hardening and Best Practices

A systems technician is tasked with re-hardening a company laptop that was recently returned from a high-risk remote assignment before allowing it back onto the internal corporate network. Arrange the following workstation hardening and remediation steps in the correct procedural sequence from first to last.

  1. 1Disconnect all physical and wireless network interfaces to isolate the device.
  2. 2Boot the system using a trusted external rescue disk to perform an offline malware scan.
  3. 3Disable the built-in Guest account and unbind non-essential network protocol bindings and services.
  4. 4Configure Local Security Policy to enforce password-protected screen saver locks and disable AutoPlay/AutoRun.
  5. 5Connect the workstation to a restricted remediation VLAN to apply system updates and patch definitions.

Cevap

The correct sequence for re-hardening the remote workstation is: 1) Disconnect all physical and wireless network interfaces to isolate the device, 2) Boot the system using a trusted external rescue disk to perform an offline malware scan, 3) Disable the built-in Guest account and unbind non-essential network protocol bindings and services, 4) Configure Local Security Policy to enforce password-protected screen saver locks and disable AutoPlay/AutoRun, and 5) Connect the workstation to a restricted remediation VLAN to apply system updates and patch definitions.
Hardening a returning untrusted endpoint must always follow a defense-in-depth sequence: Isolation → Verification/Cleaning → OS Baseline Reduction → Policy Enforcement → Segregated Updating. Isolating network access first prevents threat proliferation. Offline scanning verifies system integrity. Disabling unused accounts and services reduces attack surface. Enforcing Local Security Policy ensures endpoint operational security, and using a segregated remediation VLAN allows patching without exposing production assets.

Adım Adım Çözüm

1
Isolate the endpoint
Network communication is completely severed.
Prevents command-and-control communication or lateral movement of potential malware while the device is in an unverified security state.
2
Perform offline security verification
Malware scan completes without OS-level interference.
Scanning offline guarantees that malicious kernel drivers or rootkits are inactive and detectable.
3
Apply attack surface reduction baselines
Unused services, protocols, and default accounts are disabled.
Eliminating unnecessary services minimizes potential vectors for unauthorized local or remote access.
4
Enforce endpoint compliance policies
Screensaver locks and AutoPlay restrictions are active.
Configuring Local Security Policy hardens the OS against physical tampering and unauthorized removable media execution.
5
Patch and update in a controlled environment
OS patches and antivirus signatures are fully updated.
Using a isolated remediation VLAN ensures updates are retrieved safely before the endpoint is granted production network access.

Anahtar Kavram

Workstation Hardening and Incident Remediation Lifecycle
Bu soruyu puanla

Konular

Workstation Hardening and Best Practices

Bu konudan daha fazla soru