Which assessment conducts a configuration-level check to identify system configurations, user directories, file systems, and registry settings to evaluate potential compromise?

Which assessment conducts a configuration-level check to identify system configurations, user directories, file systems, and registry settings to evaluate potential compromise?

• A. Wireless Network Assessment
• B. Host-based Assessment
• C. Distributed Assessment
• D. Application Assessment

Answer: (B)

This type of assessment examines the local configuration of each endpoint to uncover signs of compromise. It digs into how the system is set up, looking at the operating system configuration, user directories, the layout of the file system, and the Windows registry to spot deviations from a secure baseline. By collecting data on registry keys, startup items, services, permissions, and other configuration details, it can reveal persistence mechanisms, misconfigurations, or abnormal changes that attackers use to establish and maintain access. This host-centric view is essential for identifying compromises that are baked into the endpoint itself, not just in the network or in applications. Wireless network assessment, by contrast, centers on network access points, encryption, and wireless traffic. A distributed assessment collects data from multiple systems across the network but can be broader in scope and not necessarily focused on the granular host configurations like registry settings. An application assessment targets the security of software applications, including code, modules, and application-level controls, rather than the host’s overall configuration.

This type of assessment examines the local configuration of each endpoint to uncover signs of compromise. It digs into how the system is set up, looking at the operating system configuration, user directories, the layout of the file system, and the Windows registry to spot deviations from a secure baseline. By collecting data on registry keys, startup items, services, permissions, and other configuration details, it can reveal persistence mechanisms, misconfigurations, or abnormal changes that attackers use to establish and maintain access. This host-centric view is essential for identifying compromises that are baked into the endpoint itself, not just in the network or in applications.

Wireless network assessment, by contrast, centers on network access points, encryption, and wireless traffic. A distributed assessment collects data from multiple systems across the network but can be broader in scope and not necessarily focused on the granular host configurations like registry settings. An application assessment targets the security of software applications, including code, modules, and application-level controls, rather than the host’s overall configuration.