A security team has a limited budget and must choose between running a full vulnerability scan or a penetration test this quarter. The organization's main concern is meeting compliance requirements that mandate regular vulnerability assessments. The team also wants to identify exploitable weaknesses. Which choice best balances compliance and security insight?

Run the penetration test because it provides deeper insight into exploitable weaknesses.

Run a limited penetration test on the most critical systems and use the results to infer the rest.

Run the vulnerability scan because it is required for compliance and provides broad coverage.

Skip both and rely on vendor security advisories.

A security team is planning vulnerability scans for a network that includes both production servers and a lab environment where new software is tested. The team wants to avoid false positives and reduce the chance of disrupting production. Which scanning strategy is best?

Scan only the production environment because the lab is not important.

Use passive scanning for both environments to avoid any disruption.

Scan the lab environment with an unauthenticated scan and the production environment with an authenticated scan.

Scan both environments with the same credentials and schedule.

Why is continuous reassessment necessary in a vulnerability management program?

Because vulnerability scanners become outdated and need to be replaced frequently.

Because regulatory requirements demand daily scanning of all systems.

Because a single scan can only detect a limited number of vulnerability types.

Because new vulnerabilities are discovered and systems change over time.

A company has 5,000 endpoints that are frequently off the corporate network (laptops, remote workers). The security team needs continuous vulnerability visibility for these devices, even when they are not connected to the VPN. Which scanning approach is most appropriate?

Use an active scanner on the internal network during business hours.

Perform a passive scan by monitoring DNS queries from the corporate proxy.

Schedule an external network scan from the cloud against each endpoint's public IP.

Deploy an agent on each endpoint that reports scan results when the device connects to the internet.

A security manager wants to validate whether a recently patched critical application is actually resistant to a specific known attack technique. The team has a full vulnerability assessment report but no evidence of whether the exploit would succeed. Which activity should they perform?

Apply a compensating control such as a web application firewall rule.

Review the CVSS scores of all findings to estimate the likelihood of exploitation.

Run another authenticated vulnerability scan with the latest plugin set.

Conduct a penetration test that attempts to exploit the known technique against the application.

GIAC Critical Controls Certification

Domain 5Objective 2

Continuous Vulnerability Management GCCC Practice Questions (Page 1)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 1–5

1expert · hard
A security team has a limited budget and must choose between running a full vulnerability scan or a penetration test this quarter. The organization's main concern is meeting compliance requirements that mandate regular vulnerability assessments. The team also wants to identify exploitable weaknesses. Which choice best balances compliance and security insight?
Select an answer first
2application · medium
A security team is planning vulnerability scans for a network that includes both production servers and a lab environment where new software is tested. The team wants to avoid false positives and reduce the chance of disrupting production. Which scanning strategy is best?
Select an answer first
3foundation · easy
Why is continuous reassessment necessary in a vulnerability management program?
Select an answer first
4application · medium
A company has 5,000 endpoints that are frequently off the corporate network (laptops, remote workers). The security team needs continuous vulnerability visibility for these devices, even when they are not connected to the VPN. Which scanning approach is most appropriate?
Select an answer first
5application · medium
A security manager wants to validate whether a recently patched critical application is actually resistant to a specific known attack technique. The team has a full vulnerability assessment report but no evidence of whether the exploit would succeed. Which activity should they perform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.