ThreatLocker Practice Exam

These questions are part of the practice quiz. Start practicing

• How does ThreatLocker assist in compliance regulations?
• Which of the following are valid switches when deploying via Command Prompt with the Stub Installer?
• What status should you strive to keep your endpoints in to ensure maximum protection?
• Amanda wants to control internal access to her fileserver. Which option should she select in the Object dropdown menu?
• Where can organizations set their specific application policies in the ThreatLocker Portal?
• When viewing the "Add to Application" window, the newest rules will be __________.
• Is the statement true or false: The most secure way to permit a file is by hash?
• What are tags in the context of application policy management?
• How does ThreatLocker's ringfencing feature enhance security?
• What is the result of establishing ringfencing around applications?
• What is the purpose of Installation Mode in software installation?
• How does ThreatLocker help manage software vulnerabilities?
• What method is primarily used for ThreatLocker management?
• Who has the authority to grant access to an application from an application request?
• What does ThreatLocker do when custom rules are created?
• Which statement about software licensing is true?
• What feature allows you to limit an application's interaction with your system?
• What is the name of the application where ThreatLocker places files it identifies as drivers?
• Which mode can allow end users to receive a popup notification?
• What does the status of "Secured" indicate in relation to Ringfencing?
• What does 'contextual awareness' mean in the context of ThreatLocker?
• How does ThreatLocker support incident response?
• How does ThreatLocker significantly reduce the attack surface for businesses?
• Which of the following describes the purpose of Policy Actions?
• Where will you find a list of organizations you have permission to view in the ThreatLocker Portal?
• What is a primary method for ThreatLocker to maintain security?
• How does ThreatLocker facilitate incident analysis?
• What does Installation Mode do in a security context?
• What are the ways to change your endpoints to a secured status according to ThreatLocker?
• How can alerts be set up for when new ThreatLocker policies are triggered?
• What is the primary responsibility of a ThreatLocker administrator?
• To add a tag to a policy, which tab must be selected after checking the box in the "Internet" tab?
• What happens if you set a GroupName to an invalid option during installation?
• What is the purpose of Storage Control in ThreatLocker?
• What is the default selection for creating and applying policies after the Baseline upload?
• What core principle does ThreatLocker primarily rely on for security?
• What might occur if ThreatLocker policies are too strict?
• What would likely happen if a student tried to run a disallowed application?
• In what way can ThreatLocker assist in controlling user application requests?
• Where is the InstallKey located according to the ThreatLocker Portal documentation?
• What feature allows multiple computers to quickly enter learning mode without individual configuration?
• Which of the following is an example of system software?
• What is the default duration of Learning Mode for new installs of ThreatLocker?
• Why are regular policy audits essential in ThreatLocker?
• Signed files should be permitted by certificate and one of these options:
• What is application whitelisting?
• A policy set for a single computer will be processed before what?
• What should be done to ensure the reliability of Authorization Hosts?
• Which of the following is NOT an intent of using baselining in ThreatLocker?
• In the context of ThreatLocker, what does 'Info' signify regarding threat levels?
• What ensures that the ThreatLocker Agent receives the correct version during installation?
• Which file is preferred for manually installing the ThreatLocker Agent?
• What is a key feature of collaboration tools in ThreatLocker?
• What does 'Zero Trust' mean in the context of ThreatLocker?
• Why is user training important when implementing ThreatLocker?
• What is the main goal of the ThreatLocker policies?
• What do the settings determine while on the Regular Update Channel?
• What functionality does 'Self-Service' provide in ThreatLocker?
• Which fields can be edited or configured when creating or editing a Configuration Manager policy?
• Where in the ThreatLocker Portal can you access the Configuration Manager?
• What method does ThreatLocker use to determine what to create policies for during the initial learning period?
• Application control policies are processed from which order?
• Which statement is true regarding file permissions and security?
• What actions can ThreatLocker Ops be configured to take when detecting malicious behavior?
• What alert severity corresponds to a threat level increase of 5?
• What determines the Computer Group placement when deploying the ThreatLocker agent?
• What is one of the first actions to take regarding organization-level policies when implementing application-specific Elevation policies?
• What does a health center alert severity of 'Log' indicate?
• Which of the following is the second best method for permitting files?
• What is the function of the built-in application definition?
• Which option is profiled during real-time learning but not during baselining?
• What occurs when an unauthorized application attempts to execute under ThreatLocker?
• Which type of software is designed for end-users to perform tasks?
• What is the first step in setting up ThreatLocker?
• What is the use of ThreatLocker's file system control feature?
• Which of the following best describes the role of the Unified Audit in ThreatLocker?
• Why does ThreatLocker recommend adding Ringfencing restrictions to elevated applications?
• How does ThreatLocker contribute to overall business operations?
• What must be done after Network Control is set to Monitor mode?
• What happens when you approve an Elevation Request in ThreatLocker?
• Which two default storage policies are disabled initially?
• ThreatLocker requests can only be approved by a(n) ________.
• To search for all files that were called by a specific process, use the __________ search box.
• How does ThreatLocker support virtual environments?
• Which modes disable file blocking temporarily?
• What is one way organizations can benefit from using ThreatLocker?
• How does ThreatLocker categorize an application in terms of interaction?
• Which feature supports Objects in a single LAN multi-WAN environment for versions above 8.2?
• Is there a required duration to leave your endpoints in learning mode?
• What do 'Policy Conditions' refer to in ThreatLocker terminology?
• What is the correct syntax for adding an IPv4 address to a tag?
• How does ThreatLocker manage third-party software integrations?
• Which policies are created by default for the Servers group in ThreatLocker?
• How does ThreatLocker help in monitoring application behavior?
• What is the purpose of antimalware software?
• What benefit do continuous updates to ThreatLocker's threat intelligence database provide?
• What type of log can be accessed in the Unified Audit section of the ThreatLocker Portal?
• What aspect of application management is emphasized by ThreatLocker?
• What benefit does ThreatLocker provide regarding application usability?
• In ThreatLocker, what is meant by 'policy enforcement'?
• Which information can you see by expanding an entry in the Unified Audit?
• What is the main goal of learning mode in ThreatLocker?
• What type of reports can ThreatLocker generate?
• What characteristic does Installation Mode lack in terms of file execution?
• What type of files does the ThreatLocker system primarily focus on?
• What is ThreatLocker’s approach to protecting against ransomware?
• What is one key aspect of application monitoring that ThreatLocker performs?
• What types of policies can be created in ThreatLocker?
• Where can you find the Stub Installer when adding a new computer in the ThreatLocker Portal?
• What types of logs does ThreatLocker generate?
• Which of the following statements about ThreatLocker Ops policies is true?
• What does real-time monitoring in ThreatLocker help to achieve?
• How can you add two suggested policies to an already selected policy level?
• What function do tags serve in policy management?
• Which of the following best describes ThreatLocker's purpose?
• What happens once the elevation on an application expires?
• How can you set a policy to observe registry changes made by an application without blocking those actions?
• How does ThreatLocker aim to provide actionable security insights?
• What is a common function of operating systems?
• If a USB drive is used on a PC in Learning Mode with a storage policy denying USB access, what will happen?
• After installing new software or updating, you should ____________.
• Which method can ThreatLocker use to block Remote Desktop Protocol (RDP)?
• What is referred to as the period of time between the initial learning days and the present in ThreatLocker?
• What application interaction does ThreatLocker recommend preventing with Ringfencing?
• What is a common method to enforce least privilege access with ThreatLocker?
• Can policies in ThreatLocker be adjusted automatically?
• What is the function of the 'suppress' feature in ThreatLocker?
• What should be done before implementing ThreatLocker in a production environment?
• Which of the following languages is typically used to write system software?
• What is typically the primary purpose of utility software?
• What does a combination of path, process, and created signify?
• Which ThreatLocker Module(s) can ThreatLocker Ops interact with?
• What role does the ThreatLocker Agent play?
• How long is Installation Mode enabled by default?
• Which statement is true regarding custom applications in ThreatLocker?
• Where can you quickly compare the hash of a file observed in your environment?
• What resource does ThreatLocker provide for user education?
• Given the audit excerpt, what is the most secure way to allow specific files?
• How frequently does ThreatLocker update its threat intelligence database?
• What button can be leveraged to significantly reduce your policy list in ThreatLocker?
• Which of the following is NOT a way to resolve a conflicting public and private IP address in a Local Area Network (LAN)?
• What option is available when using the Maintenance Mode window compared to the quick dropdown menu?
• Which of the following statements about Web Extensions in ThreatLocker is true?
• How does ThreatLocker enhance its profiling during the initial learning phase?
• What would be the expected search result of an Advanced Search for processes ending with .exe?
• Which characteristic distinguishes application software from system software?
• Are unsigned files created on the fly, such as those in C:\windows\temp\*, allowed by certificate and process path?
• How often should ThreatLocker policies be reviewed?
• What can be used to permit brand new software without switching to learning or installation mode?
• Which computer mode catalogs all the files installing and executing in your environment?
• Which component allows for the organized grouping of computers in the ThreatLocker Portal?
• Where can you review your Lookback Period for denied files in the ThreatLocker Portal?
• Can ThreatLocker integrate with Active Directory?
• What risk is associated with user-generated applications in ThreatLocker?
• Which options can be utilized to deploy/install the ThreatLocker Agent?
• What does an "Application" request signify?
• Which of the following software types helps in troubleshooting and maintaining systems?
• What is an important feature of ThreatLocker's dashboard?
• In the context of Elevation policies, what key feature is important to prevent application security risks?
• What type of files does ThreatLocker generate to maintain system integrity during Learning Mode?
• What port must be configured to set up an Authorization Host?
• What is the correct order of the Policy Hierarchy from first to last?
• Why is application lifecycle management important in ThreatLocker?
• Which of the following correctly summarizes what ThreatLocker does?
• What will you view if you click on the smaller "Jetbrains" that the red arrow is pointing to?
• Why is regular software updates important?
• Which types of files are included in the protected files by default?
• While in Automatic Learning Mode, where does ThreatLocker place learned IP addresses for an application with Ringfencing?
• What do collaboration features in ThreatLocker enhance?
• What is defined as a set of file hashes, certificates, or other custom rules crucial for the functioning of an application?
• Which folder is automatically learned during baselining?
• NC Authorization Hosts rely on keyword handshakes to allow communication every how many minutes?
• Which is an advantage of using tags in policy management?
• What is the role of drivers in a computer system?
• Which of the following is a benefit of the principle of least privilege in ThreatLocker?
• What happens when ThreatLocker policies are not configured correctly on a client PC?
• What is required to effortlessly manage policies in ThreatLocker?
• What is the significance of threat intelligence in ThreatLocker?
• Which part of the ThreatLocker Portal menu is used to view/edit Application Control policies?
• What should be the main focus when dealing with endpoint protection?
• Which role is essential for overseeing and approving application requests in ThreatLocker?
• What is true about drivers according to ThreatLocker?
• Which of the following are not impacted by a computer being in Learning Mode?
• By default, which local folders does ThreatLocker monitor?
• Which of the following describes a software bug?
• What does Bob's custom rule allow regarding .dll files?
• What is the most secure method to allow a file with a dynamic file name in the windows\temp folder?
• When enabling Network Control Policies, what mode does it initially go into?
• Which of the following is true about signed files?
• What does open-source software mean?
• When deploying the ThreatLocker agent, which command is used in Command Prompt after downloading the Stub Installer?
• How does ThreatLocker prioritize alerts for security incidents?
• What mechanism does ThreatLocker use to evaluate application trust?
• If both an organization-level policy and a computer group-level Elevation policy exist for the same application, which policy takes precedence?
• Which of the following best describes the ThreatLocker modules?
• Which of the following is a common characteristic of proprietary software?
• If a GroupName does not match Workstations or Servers, what will happen?
• What can be configured within a policy regarding visibility?
• What is the term used for your company's Unique Identifier in the ThreatLocker Portal?
• What is one method to stop ThreatLocker from monitoring a configuration?
• What is an essential component of ThreatLocker's endpoint security?
• What is the primary focus of ThreatLocker's policies?
• Which of the following statements is true about software?
• What strategy does ThreatLocker use to manage false positives?
• In the ThreatLocker Portal, what is the purpose of the Approval Center?
• In the ThreatLocker environment, the majority of learning occurs within what time frame?
• How can ThreatLocker support business continuity for organizations?
• What is ThreatLocker primarily used for?
• What kind of access controls does ThreatLocker enforce?
• What action is triggered by a health alert with a severity of 'Danger'?
• How does ThreatLocker manage updates to applications?
• Which component is essential to monitor file access through ThreatLocker policies?
• During Learning Mode, where does ThreatLocker place Miscellaneous Windows files it profiles?
• Which of the following functionalities can both Installation Mode and Learning Mode enable?
• What is the first step in the process to enable Elevation on your account?
• What feature in ThreatLocker assists in tracking changes to security policies?
• Where can you find advanced options like scheduling a start time when changing to Maintenance Mode?
• In order from most secure to least secure, which is the first parameter for permitting a file?
• What is required to apply changes to tags effectively?
• During which mode would you expect ThreatLocker to restrict the installation of unauthorized applications?
• In the ThreatLocker Portal, where can you view all approval requests received from end users?
• When can changes to elevated permissions typically be revoked?
• Where can a comprehensive activity log for an organization be viewed in the ThreatLocker Portal?