Endpoint Security (Security+) Quiz: EDR, HIDS & Hardening

1. Which of the following best describes a Host-based Intrusion Detection System (HIDS)?

A network device that monitors traffic between servers

Software installed on individual hosts to detect malicious activity

A firewall rule that blocks suspicious IP addresses

A centralized logging system for all network events

2. In endpoint security, what does 'threat hunting' typically involve?

Waiting passively for alerts

Proactively searching for indicators of compromise

Only responding to user complaints

Blocking all external connections

3. Which endpoint hardening control prevents privilege escalation attacks?

Enabling screen savers

Implementing user access controls and removing unnecessary admin rights

Increasing network bandwidth

Adding more RAM to the system

4. What is the primary advantage of deploying HIDS across an organization?

It eliminates the need for network-based intrusion detection

It provides host-level visibility into suspicious activities

It prevents all types of malware automatically

It removes the need for employee training

5. Hardening an endpoint includes configuring the firewall. Which rule approach is most secure?

Allow all traffic by default

Deny all traffic by default; allow only necessary ports

Allow only HTTP and HTTPS traffic

Disable the firewall for performance

6. Which of the following is a key difference between EDR and traditional antivirus?

EDR focuses only on file signatures; antivirus monitors behavior

EDR provides behavioral analysis and threat hunting; antivirus relies mainly on signatures

Antivirus is more expensive than EDR

EDR cannot detect known malware

7. True or False: HIDS can detect unauthorized file modifications on a host system.

True

False

8. In endpoint security, what does 'defense in depth' mean?

Using a single, powerful security tool

Implementing multiple layers of security controls

Focusing security efforts only on the network perimeter

Relying solely on user awareness training

9. EDR platforms typically provide which of the following capabilities?

Threat hunting, incident response, and forensic analysis

Email filtering only

Web browsing acceleration

User interface customization

10. Which endpoint hardening technique limits user access to only necessary resources?

Principle of least privilege

Full disk encryption

Network segmentation only

Disabling user accounts

11. Which practice is essential for endpoint hardening on Windows systems?

Enabling all network ports for flexibility

Installing the latest security patches and updates

Removing all antimalware software

Disabling Windows Defender completely

12. True or False: EDR solutions can only detect threats; they cannot respond to them automatically.

True

False

13. In endpoint hardening, what does disabling unnecessary services primarily reduce?

Network bandwidth consumption

The attack surface available to threat actors

User productivity and application performance

The need for endpoint backups

14. What is the primary function of an Endpoint Detection and Response (EDR) solution?

Monitor and respond to threats on endpoints in real-time

Replace all antivirus software on a network

Encrypt all data at rest on devices

Manage user passwords across the organization

15. True or False: EDR solutions require internet connectivity to function; they cannot operate offline.

True

False

16. What does a HIDS typically monitor to detect intrusions?

Only network packets entering the device

System logs, file changes, and process behavior

Only user login attempts

Email traffic exclusively

17. True or False: EDR solutions can perform automated threat response actions like isolating an infected endpoint.

True

False

18. True or False: HIDS is more effective than EDR at detecting zero-day exploits.

True

False

19. Which of the following is NOT a typical endpoint hardening measure?

Disabling unnecessary network services

Applying security patches regularly

Removing all user access restrictions

Enabling full-disk encryption

Submit

Endpoint Security Quiz: Can You Master EDR, HIDS & Hardening?

1. Which of the following best describes a Host-based Intrusion Detection System (HIDS)?

2.

What first name or nickname would you like us to use?

2. In endpoint security, what does 'threat hunting' typically involve?

3. Which endpoint hardening control prevents privilege escalation attacks?

4. What is the primary advantage of deploying HIDS across an organization?

5. Hardening an endpoint includes configuring the firewall. Which rule approach is most secure?

6. Which of the following is a key difference between EDR and traditional antivirus?

7. True or False: HIDS can detect unauthorized file modifications on a host system.

8. In endpoint security, what does 'defense in depth' mean?

9. EDR platforms typically provide which of the following capabilities?

10. Which endpoint hardening technique limits user access to only necessary resources?

11. Which practice is essential for endpoint hardening on Windows systems?

12. True or False: EDR solutions can only detect threats; they cannot respond to them automatically.

13. In endpoint hardening, what does disabling unnecessary services primarily reduce?

14. What is the primary function of an Endpoint Detection and Response (EDR) solution?

15. True or False: EDR solutions require internet connectivity to function; they cannot operate offline.

16. What does a HIDS typically monitor to detect intrusions?

17. True or False: EDR solutions can perform automated threat response actions like isolating an infected endpoint.

18. True or False: HIDS is more effective than EDR at detecting zero-day exploits.

19. Which of the following is NOT a typical endpoint hardening measure?

20. EDR solutions collect telemetry data primarily to____.