Free GIAC Critical Controls Certification Exam GCCC Exam Practice Test

Which of the following will decrease the likelihood of eavesdropping on a wireless network?

• Broadcasting in the 5Ghzfrequency
• Using Wired Equivalent Protocol(WEP)
• Using EAP/TLS authentication and WPA2 with AES encryption
• Putting the wireless network on a separate VLAN

Which of the following statements is appropriate in an incident response report?

• There had been a storm on September 27th that may have caused a power surge
• The registry entry was modified on September 29th at 22:37
• The attacker may have been able to access the systems due to missing KB2965111
• The backup process may have failed at 2345 due to lack of available bandwidth

Which of the following should be used to test antivirus software?

• FIPS 140-2
• Code Red
• Heartbleed
• EICAR

Which of the following baselines is considered necessary to implement the Boundary Defense CIS Control?

• Multi-Factor Authentication Standard
• Network Traffic/Service Baseline
• Network Device Configuration Baselines
• Network Information Flow

Johnisimplementing acommercial backupsolutionforhisorganization. Whichofthe following steps should be on the configuration checklist?

• Enable encryption if it ’s not enabled by default
• Disable software-level encryption to increase speed of transfer
• Develop a unique encryptionscheme

An Internet retailer's database was recently exploited by a foreign criminal organization via a remote attack. The initial exploit resulted in immediate root-level access. What could have been done to prevent this level ofaccess being given tothe intruder upon successful exploitation?

• Configure the DMZ firewall to block unnecessary service
• Install host integrity monitoring software
• Install updated anti-virus software
• Configure the database to run with lower privileges

Which of the following is necessary for implementing and automating the Continuous Vulnerability Assessment and Remediation CISControl?

• Software Whitelisting System
• System Configuration Enforcement System
• Patch Management System
• Penetration Testing System

Anorganizationisimplementing acontrol for the Limitationand Control of Network Ports, Protocols, and Services CIS Control. Which action should they take when they discover that an applicationrunning on a web server is no longer needed?

• Uninstall the application providing theservice
• Turn the service off in the host configuration files
• Block the protocol for the unneeded service at the firewall
• Create an access list on the router to filter traffic to the host

Which of the options below will do the most to reduce an organization’s attack surface on the internet?

• Deploy an access control list on the perimeter router and limit inbound ICMP messages to echo requests only
• Deploy antivirus software on internet-facing hosts, and ensure that the signatures are updated regularly
• Ensure that rotation of duties is used with employees in order to compartmentalize the most important tasks
• Ensure only necessary services are running on Internet-facing hosts, and that they are hardened according to best practices

An organization wants to test its procedure for data recovery. Which of the following will be most effective?

• Verifying a file can be recovered from backup media
• Verifying that backup process is running when it should
• Verifying that network backups can’t be read in transit
• Verifying there are no errors in the backup server logs