Easter Sale Special 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

GIAC Critical Controls Certification (GCCC) Question and Answers

GIAC Critical Controls Certification (GCCC)

Last Update May 18, 2024
Total Questions : 93

We are offering FREE GCCC GIAC exam questions. All you do is to just go and sign up. Give your details, prepare GCCC free exam questions and then go for complete pool of GIAC Critical Controls Certification (GCCC) test questions that will help you more.

GCCC pdf

GCCC PDF

$35  $99.99
 Add to Cart
GCCC Engine

GCCC Testing Engine

$42  $119.99
 Add to Cart
GCCC PDF + Engine

GCCC PDF + Testing Engine

$56  $159.99
 Add to Cart
Questions 1

Which of the following is necessary for implementing and automating the Continuous Vulnerability Assessment and Remediation CIS Control?

Options:

A.  

Software Whitelisting System

B.  

System Configuration Enforcement System

C.  

Patch Management System

D.  

Penetration Testing System

Discussion 0
Questions 2

A global corporation has major data centers in Seattle, New York, London and Tokyo. Which of the following is the correct approach from an intrusion detection and event correlation perspective?

Options:

A.  

Configure all data center systems to use local time

B.  

Configure all data center systems to use GMT time

C.  

Configure all systems to use their default time settings

D.  

Synchronize between Seattle and New York, and use local time for London and Tokyo

Discussion 0
Questions 3

John is implementing a commercial backup solution for his organization. Which of the following steps should be on the configuration checklist?

Options:

A.  

Enable encryption if it ’s not enabled by default

B.  

Disable software-level encryption to increase speed of transfer

C.  

Develop a unique encryption scheme

Discussion 0
Questions 4

Acme Corporation performed an investigation of its centralized logging capabilities. It found that the central server is missing several types of logs from three servers in Acme's inventory. Given these findings, what is the most appropriate next step?

Options:

A.  

Define processes to manually review logs for the problem servers

B.  

Restart or reinstall the logging service on each of the problem servers

C.  

Perform analysis to identify the source of the logging problems

D.  

Document the missing logs in the core evaluation report as a minor issue

Discussion 0
Questions 5

According to attack lifecycle models, what is the attacker’s first step in compromising an organization?

Options:

A.  

Privilege Escalation

B.  

Exploitation

C.  

Initial Compromise

D.  

Reconnaissance

Discussion 0
Questions 6

Beta corporation is doing a core evaluation of its centralized logging capabilities. The security staff suspects that the central server has several log files over the past few weeks that have had their contents changed. Given this concern, and the need to keep archived logs for log correction applications, what is the most appropriate next steps?

Options:

A.  

Keep the files in the log archives synchronized with another location.

B.  

Store the files read-only and keep hashes of the logs separately.

C.  

Install a tier one timeserver on the network to keep log devices synchronized.

D.  

Encrypt the log files with an asymmetric key and remove the cleartext version.

Discussion 0
Questions 7

Which of the following CIS Controls is used to manage the security lifecycle by validating that the documented controls are in place?

Options:

A.  

Controlled Use of Administrative Privilege

B.  

Account Monitoring and Control

C.  

Data Protection

D.  

Penetration Tests and Red Team Exercises

Discussion 0
Questions 8

Which of the following should be measured and analyzed regularly when implementing the Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers CIS Control?

Options:

A.  

How long does it take to identify new unauthorized listening ports on the network systems

B.  

How long does it take to remove unauthorized software from the organization’s systems

C.  

What percentage of the organization’s applications are using sandboxing products

D.  

What percentage of assets will have their settings enforced and redeployed

E.  

What percentage of systems in the organization are using Network Level Authentication (NLA)

Discussion 0
Questions 9

What type of Unified Modelling Language (UML) diagram is used to show dependencies between logical groupings in a system?

Options:

A.  

Package diagram

B.  

Deployment diagram

C.  

Class diagram

D.  

Use case diagram

Discussion 0
Questions 10

Which of the following is a reliable way to test backed up data?

Options:

A.  

Verify the file size of the backup

B.  

Confirm the backup service is running at the proper time

C.  

Compare data hashes of backed up data to original systems

D.  

Restore the data to a system

Discussion 0
Questions 11

Which of the following actions will assist an organization specifically with implementing web application software security?

Options:

A.  

Making sure that all hosts are patched during regularly scheduled maintenance

B.  

Providing end-user security training to both internal staff and vendors

C.  

Establishing network activity baselines among public-facing servers

D.  

Having a plan to scan vulnerabilities of an application prior to deployment

Discussion 0
Questions 12

Which of the options below will do the most to reduce an organization’s attack surface on the internet?

Options:

A.  

Deploy an access control list on the perimeter router and limit inbound ICMP messages to echo requests only

B.  

Deploy antivirus software on internet-facing hosts, and ensure that the signatures are updated regularly

C.  

Ensure that rotation of duties is used with employees in order to compartmentalize the most important tasks

D.  

Ensure only necessary services are running on Internet-facing hosts, and that they are hardened according to best practices

Discussion 0
Questions 13

Which of the following is used to prevent spoofing of e-mail addresses?

Options:

A.  

Sender Policy Framework

B.  

DNS Security Extensions

C.  

Public-Key Cryptography

D.  

Simple Mail Transfer Protocol

Discussion 0
GCCC Questions Answers | GCCC Test Prep | GIAC Critical Controls Certification (GCCC) Questions PDF | GCCC Online Exam | GCCC Practice Test | GCCC PDF | GCCC Test Questions | GCCC Study Material | GCCC Exam Preparation | GCCC Valid Dumps | GCCC Real Questions | Cyber Security GCCC Exam Questions