[Q18-Q39] Certification Training for GCCC Exam Dumps Test Engine [2024]

5/5 - (3 votes)

Certification Training for GCCC Exam Dumps Test Engine [2024]

Dec 17, 2024 Step by Step Guide to Prepare for GCCC Exam

GIAC GCCC Exam is an important certification for security professionals who are looking to enhance their knowledge and skills in the critical security controls that are necessary to protect against cyber attacks. GIAC Critical Controls Certification (GCCC) certification is highly respected within the industry and can help to open up new career opportunities for those who obtain it.

To earn the GIAC GCCC certification, candidates must pass the certification exam with a minimum passing score of 73%. Candidates can prepare for the exam by attending training classes, reading study materials, and taking practice exams. GIAC Critical Controls Certification (GCCC) certification is valid for four years, after which candidates must renew their certification by earning Continuing Professional Education (CPE) credits. Overall, the GIAC GCCC certification is an excellent certification for security professionals who want to enhance their knowledge and skills in critical security controls.

Q18. Kenya is a system administrator for SANS. Per the recommendations of the CIS Controls she has a dedicated host (kenya- adminbox / 10.10.10.10) for any administrative tasks. She logs into the dedicated host with her domain admin credentials. Which of the following connections should not exist from kenya-adminbox?

10.10.245.3389

Mail.jane.org.25

Firewall_charon.jane.org.22

10.10.10.33.443

Q19. Which of the following is used to prevent spoofing of e-mail addresses?

Sender Policy Framework

DNS Security Extensions

Public-Key Cryptography

Simple Mail Transfer Protocol

Q20. Which of the following is necessary to automate a control for Inventory and Control of Hardware Assets?

A method of device scanning

A centralized time server

An up-to-date hardening guide

An inventory of unauthorized assets

Q21. What is the relationship between a service and its associated port?

A service closes a port after a period of inactivity

A service relies on the port to select the protocol

A service sets limits on the volume of traffic sent through the port

A service opens the port and listens for network traffic

Q22. Which of the following baselines is considered necessary to implement the Boundary Defense CIS Control?

Multi-Factor Authentication Standard

Network Traffic/Service Baseline

Network Device Configuration Baselines

Network Information Flow

Q23. Which CIS Control includes storing system images on a hardened server, scanning production systems for out-of-date software, and using file integrity assessment tools like tripwire?

Inventory of Authorized and Unauthorized Software

Continuous Vulnerability Management

Secure Configurations for Network Devices such as Firewalls, Routers and Switches

Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

Q24. What is a zero-day attack?

An attack that has a known attack signature but no available patch

An attack that utilizes a vulnerability unknown to the software developer

An attack that deploys at the end of a countdown sequence

An attack that is launched the day the patch is released

Q25. Which of the following is a responsibility of a change management board?

Reviewing log files for unapproved changes

Approving system baseline configurations.

Providing recommendations for the changes

Reviewing configuration of the documents

Q26. An Internet retailer’s database was recently exploited by a foreign criminal organization via a remote attack.
The initial exploit resulted in immediate root-level access. What could have been done to prevent this level of access being given to the intruder upon successful exploitation?

Configure the DMZ firewall to block unnecessary service

Install host integrity monitoring software

Install updated anti-virus software

Configure the database to run with lower privileges

Q27. Of the options shown below, what is the first step in protecting network devices?

Creating standard secure configurations for all devices

Scanning the devices for known vulnerabilities

Implementing IDS to detect attacks

Applying all known security patches

Q28. An organization is implementing a control for the Account Monitoring and Control CIS Control, and have set the Account Lockout Policy as shown below. What is the risk presented by these settings?

Brute-force password attacks could be more effective.

Legitimate users could be unable to access resources.

Password length and complexity will be automatically reduced.

Once accounts are locked, they cannot be unlocked.

Q29. After installing a software package on several workstations, an administrator discovered the software opened network port TCP 23456 on each workstation. The port is part of a software management function that is not needed on corporate workstations. Which actions would best protect the computers with the software package installed?

Document the port number and request approval from a change control group

Redirect traffic to and from the software management port to a non-default port

Block TCP 23456 at the network perimeter firewall

Determine which service controls the software management function and opens the port, and disable it

Q30. Which of the following archiving methods would maximize log integrity?

DVD-R

USB flash drive

Magnetic Tape

CD-RW

Q31. An organization has implemented a control for Controlled Use of Administrative Privileges. They are collecting audit data for each login, logout, and location for the root account of their MySQL server, but they are unable to attribute each of these logins to a specific user. What action can they take to rectify this?

Force the root account to only be accessible from the system console.

Turn on SELinux and user process accounting for the MySQL server.

Force user accounts to use ‘sudo’ f or privileged use.

Blacklist client applications from being run in privileged mode.

Q32. Why is it important to enable event log storage on a system immediately after it is installed?

To allow system to be restored to a known good state if it is compromised

To create the ability to separate abnormal behavior from normal behavior during an incident

To compare it performance with other systems already on the network

To identify root kits included on the system out of the box

Q33. According to attack lifecycle models, what is the attacker’s first step in compromising an organization?

Privilege Escalation

Exploitation

Initial Compromise

Reconnaissance

Q34. An auditor is focusing on potential vulnerabilities. Which of the following should cause an alert?

Workstation on which a domain admin has never logged in

Windows host with an uptime of 382 days

Server that has zero browser plug-ins

Fully patched guest machine that is not in the asset inventory

Q35. What is the business goal of the Inventory and Control of Software Assets Control?

Only authorized software should be installed on the agency ‘s c omput er s ys t ems

All software conforms to licensing requirements for the business

Accurate software versions are captured to enable patching

Accurate software versions and counts are documented for licensing updates

Q36. Acme Corporation performed an investigation of its centralized logging capabilities. It found that the central server is missing several types of logs from three servers in Acme’s inventory. Given these findings, what is the most appropriate next step?

Define processes to manually review logs for the problem servers

Restart or reinstall the logging service on each of the problem servers

Perform analysis to identify the source of the logging problems

Document the missing logs in the core evaluation report as a minor issue

Q37. Beta corporation is doing a core evaluation of its centralized logging capabilities. The security staff suspects that the central server has several log files over the past few weeks that have had their contents changed. Given this concern, and the need to keep archived logs for log correction applications, what is the most appropriate next steps?

Keep the files in the log archives synchronized with another location.

Store the files read-only and keep hashes of the logs separately.

Install a tier one timeserver on the network to keep log devices synchronized.

Encrypt the log files with an asymmetric key and remove the cleartext version.

Q38. Which of the following will decrease the likelihood of eavesdropping on a wireless network?

Broadcasting in the 5Ghz frequency

Using Wired Equivalent Protocol (WEP)

Using EAP/TLS authentication and WPA2 with AES encryption

Putting the wireless network on a separate VLAN

Q39. Which projects enumerates or maps security issues to CVE?

CIS Controls

SCAP

ISO 2700

NIST

Loading …

Ultimate Guide to Prepare GCCC Certification Exam for Cyber Security: https://www.testsimulate.com/GCCC-study-materials.html

Leave a Reply Cancel reply