Free GIAC Critical Controls Certification Exam GCCC Exam Practice Test

Which of the following should be used to test antivirus software?

• FIPS 140-2
• Code Red
• Heartbleed
• EICAR

Which of the following is necessary for implementing and automating the Continuous Vulnerability Assessment and Remediation CISControl?

• Software Whitelisting System
• System Configuration Enforcement System
• Patch Management System
• Penetration Testing System

What is the first step suggested before implementing any single CIS Control?

• Develop an effectiveness test
• Perform a gap analysis
• Perform a vulnerability scan
• Developaroll-outschedule

An organization has failed a test for compliance with a policy of continual detection and removal of malicious software on its network. Which of the following errors is the root cause?

• A host ran malicious software that exploited a vulnerability for which there was no patch
• The security console alerted when a host anti-virus ran whitelisted software
• The intrusion prevention system failed to update to the newest signature list
• A newly discovered vulnerability was not detected by the intrusion detection system

Which of the following can be enabled on a Linux based system in order to make it more difficult for an attacker to execute malicious code after launching a buffer overflow attack?

• ASLR
• Tripwire
• SUID
• Iptables
• TCP Wrappers

According to attack lifecycle models, what is the attacker’s first step in compromising an organization?

• Privilege Escalation
• Exploitation
• Initial Compromise
• Reconnaissance

How often should the security awareness program be communicated to employees?

• Continuously
• Annually
• Monthly
• At orientation and reviewtimes

What could a security team use the command line tool Nmap for when implementing the Inventory and Control of Hardware Assets Control?

• Control which devices can connect to the network
• Passively identify new devices
• Inventory offline databases
• Actively identify new servers

Which of the following is used to prevent spoofing of e-mail addresses?

• Sender Policy Framework
• DNS Security Extensions
• Public-Key Cryptography
• Simple Mail Transfer Protocol

Whenevaluating the Wireless Access Control CISControl, whichofthefollowing systems needs to be tested?

• Log management system
• 802.1x authentication systems
• Data classification and access baselines
• PII data scanner