PSE-ENDPOINT practice question 10 of 10

An administrator is testing an exploit that is expected to be blocked by the JIT Mitigation EPM protecting the viewer application in use. No prevention occurs, and the attack is successful. In which two ways can the administrator determine the reason for the missed prevention? (Choose two.)

Answer options

A: Check in the HKLM\SYSTEM\Cyvera\Policy registry key and subkeys whether JIT Mitigation is enabled for this application Correct answer

B: Check if a Just-In-Time debugger is installed on the system

C: Check that the Traps libraries are injected into the application Correct answer

D: Check that all JIT Mitigation functions are enabled in the HKLM\SYSTEM\Cyvera\Policy\Organization\Process\Default registry key

Correct Answer:

A. Check in the HKLM\SYSTEM\Cyvera\Policy registry key and subkeys whether JIT Mitigation is enabled for this application; C. Check that the Traps libraries are injected into the application

Keep practicing

Take the free PSE-ENDPOINT practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test