GCCC questions and answers

Acme Corporation performed an investigation of its centralized logging capabilities. It found that the central server is missing several types of logs from three servers in Acme's inventory.
Given these findings, what is the most appropriate next step?

What is the first step suggested before implementing any single CIS Control?

When evaluating the Wireless Access Control CIS Control, which of the following systems needs to be tested?

A global corporation has major data centers in Seattle, New York, London and Tokyo.

Which of the following is the correct approach from an intrusion detection and event correlation perspective?

What is a recommended defense for the CIS Control for Application Software Security?

An organization has implemented a control for penetration testing and red team exercises conducted on their network. They have compiled metrics showing the success of the penetration testing (Penetration Tests), as well as the number of actual adversary attacks they have sustained (External Attacks). Assess the metrics below and determine the appropriate interpretation with respect to this control.

An organization wants to test its procedure for data recovery.

Which of the following will be most effective?

Of the options shown below, what is the first step in protecting network devices?

Which of the following actions will assist an organization specifically with implementing web application software security?

Which of the following is necessary for implementing and automating the Continuous Vulnerability Assessment and Remediation CIS Control?

As part of an effort to implement a control on E-mail and Web Protections, an organization is monitoring their webserver traffic.

Which event should they receive an alert on?

Dragonfly Industries requires firewall rules to go through a change management system before they are configured. Review the change management log.

Which of the following lines in your firewall ruleset has expired and should be removed from the configuration?

An organization has implemented a policy to continually detect and remove malware from its network.

Which of the following is a detective control needed for this?

After installing a software package on several workstations, an administrator discovered the software opened network port TCP 23456 on each workstation. The port is part of a software management function that is not needed on corporate workstations.

Which actions would best protect the computers with the software package installed?