Endpoint Security Best Practices

Reducing Attack Surface on Endpoints

Question

Which two components reduce the attack surface on an endpoint? (Choose two.)

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D. E.

AD.

The two components that can reduce the attack surface on an endpoint are:

A. Secure boot: Secure boot is a feature that ensures that the endpoint's boot process only runs software that is trusted and verified by the endpoint's firmware. Secure boot helps prevent malware from infecting the endpoint's boot process and provides an additional layer of protection against attacks that attempt to modify the boot process to gain unauthorized access.

D. Restricting USB ports: Restricting USB ports is a security measure that limits the ability for unauthorized devices to connect to an endpoint. By restricting USB ports, organizations can reduce the risk of malware being introduced to an endpoint through a malicious USB device. This is especially important for endpoints that are used in sensitive environments, such as those that handle sensitive data or are used in critical infrastructure.

B. Load balancing: Load balancing is a technique used to distribute network traffic across multiple endpoints. While load balancing can improve performance and availability, it does not directly reduce the attack surface on an endpoint. Instead, it can help mitigate the impact of an attack by distributing traffic across multiple endpoints, making it more difficult for an attacker to overload a single endpoint.

C. Increased audit log levels: Increasing the audit log levels on an endpoint can help provide more detailed information about system activity, including attempted attacks. While this can help organizations detect and respond to attacks more quickly, it does not directly reduce the attack surface on an endpoint.

E. Full packet captures at the endpoint: Full packet captures at the endpoint can help provide detailed information about network traffic, including potential attacks. While this can help organizations detect and respond to attacks more quickly, it does not directly reduce the attack surface on an endpoint. Additionally, capturing full packets can be resource-intensive and may not be feasible on all endpoints.