How To Study GIAC Critical Controls Certification (GCCC) Easily?

test2022-03-14T07:17:38+00:00

Want to achieve GCCC Certification to improve your credential? GIAC Critical Controls Certification (GCCC) is the only certification based on the CIS Controls, a prioritized, risk-based approach to security. If you are preparing for GCCC exam, you should get latest GCCC exam dumps to pass in the first try. You can try these GCCC sample exam questions to see if you are ready for the real exam. We provide latest updated and valid real exam questions. 100% pass rate is guaranteed.

To help you prepare for the exam, take a free practice test.

Page 1 of 3

1. What is the business goal of the Inventory and Control of Software Assets Control?

Only authorized software should be installed on the agency ’s c omput er s ys t ems

All software conforms to licensing requirements for the business

Accurate software versions are captured to enable patching

Accurate software versions and counts are documented for licensing updates

2. An analyst investigated unused organizational accounts.

The investigation found that:

- 10% of accounts still have their initial login password, indicating they were never used

- 10% of accounts have not been used in over six months

Which change in policy would mitigate the security risk associated with both findings?

Users are required to change their password at the next login after three months

Accounts must have passwords of at least 8 characters, with one number or symbol

Accounts without login activity for 15 days are automatically locked

3. Kenya is a system administrator for SANS. Per the recommendations of the CIS Controls she has a dedicated host (kenya- adminbox / 10.10.10.10) for any administrative tasks. She logs into the dedicated host with her domain admin credentials.

Which of the following connections should not exist from kenya-adminbox?

10.10.245.3389

Mail.jane.org.25

Firewall_charon.jane.org.22

10.10.10.33.443

4. Which of the following is necessary for implementing and automating the Continuous Vulnerability Assessment and Remediation CIS Control?

Software Whitelisting System

System Configuration Enforcement System

Patch Management System

Penetration Testing System

5. How can the results of automated network configuration scans be used to improve the security of the network?

Reports can be sent to the CIO for performance benchmarks

Results can be provided to network engineers as actionable feedback

Scanners can correct network configurations issues

Results can be included in audit evidence failures

6. A security incident investigation identified the following modified version of a legitimate system file on a compromised client:

C:WindowsSystem32winxml.dll Addition Jan. 16, 2014 4:53:11 PM

The infection vector was determined to be a vulnerable browser plug-in installed by the user.

Which of the organization’s CIS Controls failed?

Application Software Security

Inventory and Control of Software Assets

Maintenance, Monitoring, and Analysis of Audit Logs

Inventory and Control of Hardware Assets

7. What is an organization’s goal in deploying a policy to encrypt all mobile devices?

Enabling best practices for the protection of their software licenses

Providing their employees, a secure method of connecting to the corporate network

Controlling unauthorized access to sensitive information

Applying the principle of defense in depth to their mobile devices

8. As part of an effort to implement a control on E-mail and Web Protections, an organization is monitoring their webserver traffic.

Which event should they receive an alert on?

The number of website hits is higher that the daily average

The logfiles of the webserver are rotated and archived

The website does not respond to a SYN packet for 30 minutes

The website issues a RST to a client after the connection is idle

9. Which of the following should be used to test antivirus software?

FIPS 140-2

Code Red

Heartbleed

EICAR

10. Which type of scan is best able to determine if user workstations are missing any important patches?

A network vulnerability scan using aggressive scanning

A source code scan

A port scan using banner grabbing

A web application/database scan

A vulnerability scan using valid credentials

Page 2 of 3

11. Beta corporation is doing a core evaluation of its centralized logging capabilities. The security staff suspects that the central server has several log files over the past few weeks that have had their contents changed.

Given this concern, and the need to keep archived logs for log correction applications, what is the most appropriate next steps?

Keep the files in the log archives synchronized with another location.

Store the files read-only and keep hashes of the logs separately.

Install a tier one timeserver on the network to keep log devices synchronized.

Encrypt the log files with an asymmetric key and remove the cleartext version.

12. During a security audit which test should result in a source packet failing to reach its intended destination?

A new connection request from the Internet is sent to a host on the company ’s internal net work

A packet originating from the company’s DMZ is sent to a host on the company’s internal network

A new connection request from the internet is sent to the company’s DNS server

A packet originating from the company’s internal network is sent to the company’s DNS server

13. An organization has failed a test for compliance with a policy of continual detection and removal of malicious software on its network.

Which of the following errors is the root cause?

A host ran malicious software that exploited a vulnerability for which there was no patch

The security console alerted when a host anti-virus ran whitelisted software

The intrusion prevention system failed to update to the newest signature list

A newly discovered vulnerability was not detected by the intrusion detection system

14. When evaluating the Wireless Access Control CIS Control, which of the following systems needs to be tested?

Log management system

802.1x authentication systems

Data classification and access baselines

PII data scanner

15. Based on the data shown below.

Which wireless access point has the manufacturer default settings still in place?

Starbucks

Linksys

Hhonors

Interwebz

16. Of the options shown below, what is the first step in protecting network devices?

Creating standard secure configurations for all devices

Scanning the devices for known vulnerabilities

Implementing IDS to detect attacks

Applying all known security patches

17. What is the first step suggested before implementing any single CIS Control?

Develop an effectiveness test

Perform a gap analysis

Perform a vulnerability scan

Develop a roll-out schedule

18. An organization has installed a firewall for Boundary Defense. It allows only outbound traffic from internal workstations for web and SSH, allows connections from the internet to the DMZ, and allows guest wireless access to the internet only.

How can an auditor validate these rules?

Check for packets going from the Internet to the Web server

Try to send email from a wireless guest account

Check for packages going from the web server to the user workstations

Try to access the internal network from the wireless router

19. If an attacker wanted to dump hashes or run wmic commands on a target machine, which of the following tools would he use?

Mimikatz

OpenVAS

Metasploit

20. An auditor is focusing on potential vulnerabilities.

Which of the following should cause an alert?

Workstation on which a domain admin has never logged in

Windows host with an uptime of 382 days

Server that has zero browser plug-ins

Fully patched guest machine that is not in the asset inventory

Page 3 of 3

21. 1.Dragonfly Industries requires firewall rules to go through a change management system before they are configured. Review the change management log.

Which of the following lines in your firewall ruleset has expired and should be removed from the configuration?

access-list outbound permit tcp host 10.1.1.7 any eq smtp

access-list outbound deny tcp any host 74.125.228.2 eq www

access-list inbound permit tcp 8.8.0.0 0.0.0.255 10.10.12.252 eq 8080

access-list inbound permit tcp host 8.8.207.97 host 10.10.12.100 eq ssh

22. An organization is implementing an application software security control their custom-written code that provides web—based database access to sales partners.

Which action will help mitigate the risk of the application being compromised?

Providing the source code for their web application to existing sales partners

Identifying high-risk assets that are on the same network as the web application server

Creating signatures for their IDS to detect attacks specific to their web application

Logging the connection requests to the web application server from outside hosts

23. What is a zero-day attack?

An attack that has a known attack signature but no available patch

An attack that utilizes a vulnerability unknown to the software developer

An attack that deploys at the end of a countdown sequence

An attack that is launched the day the patch is released

24. Which CIS Control includes storing system images on a hardened server, scanning production systems for out-of-date software, and using file integrity assessment tools like tripwire?

Inventory of Authorized and Unauthorized Software

Continuous Vulnerability Management

Secure Configurations for Network Devices such as Firewalls, Routers and Switches

Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

How To Study GIAC Critical Controls Certification (GCCC) Easily?

How To Study GIAC Critical Controls Certification (GCCC) Easily?

Share this post

Author

Leave a Reply Cancel reply

Related Posts

GIAC Secure Software Programmer – .NET (GSSP-.NET) Exam Dumps