D340 Cyber Defense and Countermeasures - Set 2 - Part 1

Correct Answer: Reducing vulnerabilities by minimizing exposure and applying secure settings

Hardening removes unnecessary functionality and applies secure configuration so fewer weaknesses exist for an attacker to exploit.

Correct Answer: A consensus-developed secure configuration standard for a specific technology

CIS Benchmarks provide detailed, community-agreed secure configuration recommendations for operating systems, applications, and devices.

Correct Answer: Each running service is a potential entry point requiring patching

Every listening service expands the attack surface and must be patched and monitored. Disabling what is not needed removes that exposure entirely.

Correct Answer: Dormant accounts are attractive targets because misuse goes unnoticed

Unused accounts often retain valid credentials and privileges while nobody monitors their activity, making compromise likely to go undetected.

Correct Answer: An account remaining active after its owner has left the organization

Orphaned accounts persist after employment ends, retaining access that neither the organization nor a manager is monitoring, creating substantial risk.

Correct Answer: Verifying that granted permissions remain appropriate for current roles

Access reviews detect privilege accumulation as people change roles, ensuring permissions still match current job requirements.

Correct Answer: Gradual accumulation of access rights as an employee changes roles

Privilege creep occurs when users retain permissions from previous roles while gaining new ones, eventually holding far more access than their role requires.

Correct Answer: Controlling, monitoring, and auditing use of highly privileged accounts

PAM vaults privileged credentials, enforces approval workflows, and records privileged sessions, reducing risk from the most powerful accounts.

Correct Answer: Granting elevated rights only for a limited period when needed

Just-in-time access elevates privileges temporarily for an approved task and revokes them afterward, minimizing the window in which powerful rights exist.

Correct Answer: Compromise during routine browsing or email does not immediately yield admin rights

Routine activities such as email and browsing carry the highest compromise risk. Separating accounts prevents such compromise from directly granting administrative control.

Correct Answer: Establishing requirements that make credentials harder to compromise

Password policy sets requirements for length, complexity, reuse, and rotation that raise the difficulty of guessing, cracking, or reusing credentials.

Correct Answer: Length

Each additional character multiplies the search space, so length contributes far more to strength than complexity rules or forced frequent rotation.

Correct Answer: It drives predictable minor variations that weaken security

Frequent forced changes lead users to make small predictable modifications. Current guidance favors length, breach screening, and MFA over scheduled rotation.

Correct Answer: Using credentials leaked from one breach to access accounts elsewhere

Credential stuffing exploits password reuse, automatically testing username and password pairs from prior breaches against other services.

Correct Answer: Multi-factor authentication

Even valid stolen credentials are insufficient when a second factor is required, making MFA the single most effective control against credential stuffing.

Correct Answer: It enables unique strong passwords for every service without memorization

Password managers generate and store unique complex credentials per site, eliminating reuse, which is the underlying weakness credential stuffing exploits.

Correct Answer: Applying secure configuration and controls to workstations and laptops

Endpoint hardening applies disk encryption, patching, application control, host firewalls, and least privilege to devices where users work.

Correct Answer: Malware executing as a standard user cannot make system-wide changes

Much malware requires administrative rights to install persistently or modify system settings. Standard-user accounts substantially contain the impact of execution.

Correct Answer: Traffic filtering enforced on an individual system

A host-based firewall filters traffic at the individual system, providing protection even for traffic that never crosses the network perimeter.

Correct Answer: They restrict lateral movement between internal systems

Perimeter firewalls do not inspect traffic between internal hosts. Host firewalls constrain lateral movement after an attacker gains an internal foothold.