Study guide 10: Endpoint and mobile security
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 60 minutes
By the end of this lesson you will be able to:
- Harden endpoints by removing unneeded services and applying patches
- Compare antivirus, EDR and XDR
- Choose BYOD, COPE, CYOD and MDM controls
- Secure Bluetooth, NFC, Wi-Fi and cellular connections
Topic 10A — Endpoint security
Hardening removes unnecessary software, services and ports, changes defaults, and applies patches. Use host firewalls, HIPS, full-disk encryption and application allow lists. EDR records endpoint behavior and enables response; XDR correlates endpoint, network, email and cloud. Segmentation and secure configuration of workstations, servers and ICS reduce lateral movement.
Topic 10B — Mobile hardening
Deployment models: BYOD (personal device), COPE (corporate-owned, personally enabled), CYOD (choose from approved list), and corporate-owned. MDM enforces PIN, encryption, remote wipe, app control and containerization. Location services enable geofencing. Bluetooth risks include bluejacking and bluesnarfing; NFC enables contactless attacks at close range; avoid untrusted Wi-Fi without VPN.
Saved