KeyTrain's Key Training — Endpoint Security — free practice exam
20 original practice questions aligned to official exam domains. Run a timed, domain-weighted quiz in your browser — no login required.
Exam domains
| Domain | Weight |
|---|---|
| Malware | 20% |
| Ransomware | 20% |
| Process analysis | 20% |
| Startup persistence | 20% |
| Antivirus status | 20% |
Sample practice questions
- An analyst sees powershell.exe spawning rundll32 with no window. What should they collect FIRST?
- Which artifact BEST helps determine persistence via scheduled task creation?
- Autoruns shows an unknown scheduled task calling a binary in %ProgramData%. Action?
- Backups are immutable; leadership asks about paying ransom. Security recommendation?
- EDR detects a living-off-the-land script spawning rundll32 from WinWord. Next step?
- EDR quarantines a signed driver loading from a temp folder. Next BEST step?
- EDR shows 'protected' but Windows Defender is disabled via GPO conflict. What should you do?
- 20% of endpoints report outdated definitions for 14 days. BEST prioritized action?
- File servers show mass .encrypted extensions and a ransom note. FIRST action?
- GPO audit shows 18% of laptops with Defender disabled by local admin tools. Fix?
- Ransomware group threatens leak of stolen data. What does 'double extortion' imply?
- Registry Run keys point to a random AppData executable after an email attachment. BEST remediation?
- A server excludes the entire C: drive from scanning for 'performance.' What risk acceptance is this?
- Startup folder contains a shortcut to a remote SMB path. Risk?
- A subsidiary reports encrypted file shares but still has network connectivity. IMMEDIATE action?
- Sysmon shows powershell.exe -enc launching from excel.exe with outbound 443. Meaning?
- Task Manager shows a browser consuming CPU but Process Explorer shows no matching process. Likely explanation?
- Users download 'free PDF tools' from ads. Which control reduces malware installs?
- A WMI event subscription recreates malware after reboot. Why is this effective persistence?
- A Word doc with macros calls out to a paste site. Classification?