How do you secure a Windows workstation against malware and unauthorized access?

How do you secure a Windows workstation against malware and unauthorized access?

• A. Disable Windows Defender and rely on manual scans.
• B. Enable Windows Defender/EDR, enable automatic updates, use a firewall, enable UAC, enable BitLocker, restrict USB and removable media usage, enforce device controls, and monitor with security tools.
• C. Install a firewall on a separate device only.
• D. Disable all updates to prevent reboot.

Answer: (B)

A Windows workstation stays secure when you layer protections that cover malware defense, access control, and data protection. Enabling Windows Defender with Endpoint Detection and Response provides real-time protection plus intelligent monitoring to detect and respond to threats. Keeping automatic updates on ensures the system receives the latest security patches and feature improvements, closing exploits as soon as they’re found. Using a firewall helps control network traffic to and from the device, reducing the chances of unapproved access or data leakage. UAC (User Account Control) adds a layer of privilege separation, prompting for permission when a task requires administrator rights, which helps prevent unintentional or malicious changes. BitLocker encrypts the drive so that if the device is lost or stolen, the data remains protected even without the system being unlocked. Restricting USB and removable media usage lowers the risk of malware delivery and data theft through removable devices. Enforcing device controls further limits which devices and applications can run, helping prevent unknown or unmanaged software from executing. Finally, ongoing monitoring with security tools provides visibility, alerts, and the ability to respond quickly to incidents. Disabling defenses or updates, or relying on manual scans or a single firewall device, leaves gaps that malware can exploit or use to bypass protections. This layered approach is what keeps a Windows workstation resilient against both malware and unauthorized access.

A Windows workstation stays secure when you layer protections that cover malware defense, access control, and data protection. Enabling Windows Defender with Endpoint Detection and Response provides real-time protection plus intelligent monitoring to detect and respond to threats. Keeping automatic updates on ensures the system receives the latest security patches and feature improvements, closing exploits as soon as they’re found.

Using a firewall helps control network traffic to and from the device, reducing the chances of unapproved access or data leakage. UAC (User Account Control) adds a layer of privilege separation, prompting for permission when a task requires administrator rights, which helps prevent unintentional or malicious changes. BitLocker encrypts the drive so that if the device is lost or stolen, the data remains protected even without the system being unlocked. Restricting USB and removable media usage lowers the risk of malware delivery and data theft through removable devices. Enforcing device controls further limits which devices and applications can run, helping prevent unknown or unmanaged software from executing. Finally, ongoing monitoring with security tools provides visibility, alerts, and the ability to respond quickly to incidents.

Disabling defenses or updates, or relying on manual scans or a single firewall device, leaves gaps that malware can exploit or use to bypass protections. This layered approach is what keeps a Windows workstation resilient against both malware and unauthorized access.