Cyber Monday Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

GIAC GCCC - GIAC Critical Controls Certification (GCCC)

GIAC GCCC Premium Access     Download Demo    
Page: 3 / 3
Total 93 questions

Kenya is a system administrator for SANS. Per the recommendations of the CIS Controls she has a dedicated host (kenya- adminbox / 10.10.10.10) for any administrative tasks. She logs into the dedicated host with her domain admin credentials. Which of the following connections should not exist from kenya-adminbox?

A.

10.10.245.3389

B.

Mail.jane.org.25

C.

Firewall_charon.jane.org.22

D.

10.10.10.33.443

Which of the following will decrease the likelihood of eavesdropping on a wireless network?

A.

Broadcasting in the 5Ghz frequency

B.

Using Wired Equivalent Protocol (WEP)

C.

Using EAP/TLS authentication and WPA2 with AES encryption

D.

Putting the wireless network on a separate VLAN

Which of the following is necessary to automate a control for Inventory and Control of Hardware Assets?

A.

A method of device scanning

B.

A centralized time server

C.

An up-to-date hardening guide

D.

An inventory of unauthorized assets

What is the list displaying?

A.

Allowed program in a software inventory application

B.

Unauthorized programs detected in a software inventory

C.

Missing patches from a patching server

D.

Installed software on an end-user device

An auditor is focusing on potential vulnerabilities. Which of the following should cause an alert?

A.

Workstation on which a domain admin has never logged in

B.

Windows host with an uptime of 382 days

C.

Server that has zero browser plug-ins

D.

Fully patched guest machine that is not in the asset inventory

Which of the following should be measured and analyzed regularly when implementing the Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers CIS Control?

A.

How long does it take to identify new unauthorized listening ports on the network systems

B.

How long does it take to remove unauthorized software from the organization’s systems

C.

What percentage of the organization’s applications are using sandboxing products

D.

What percentage of assets will have their settings enforced and redeployed

E.

What percentage of systems in the organization are using Network Level Authentication (NLA)

What is the first step suggested before implementing any single CIS Control?

A.

Develop an effectiveness test

B.

Perform a gap analysis

C.

Perform a vulnerability scan

D.

Develop a roll-out schedule