A security team needs to scan a mix of internal servers and cloud workloads that are only reachable through a private network. The team wants to minimize the impact on production systems while still getting accurate results. Which scanning configuration is most appropriate?

Run an active scan from a jump host with credentials during business hours.

Use a passive network tap on the core switch to observe traffic.

Run unauthenticated scans from a cloud-based scanner over the internet.

Deploy an agent-based scanner on each workload and schedule scans during off-peak hours.

A vulnerability management team has a remediation backlog. They have identified a vulnerability with a CVSS score of 7.5 on an internal file server that is not internet-facing, and a vulnerability with a CVSS score of 5.0 on an internet-facing web server that is known to be exploited in the wild. The team can only fix one this week. Which should they fix first?

Fix the web server because it is internet-facing and the vulnerability is known to be exploited.

Fix both simultaneously by reallocating resources.

Wait for the next threat intelligence feed to decide.

Fix the file server because the CVSS score is higher.

Which of the following is a key consideration when scheduling vulnerability scans across an enterprise?

Running scans only when a new vulnerability is publicly disclosed to save resources.

Scanning during peak business hours to ensure systems are active and reachable.

Coordinating scan schedules with system owners to minimize impact on business operations.

Scanning all systems at the same time to ensure a consistent snapshot of the environment.

What is the primary goal of configuration changes as a remediation strategy?

To make the system easier for users to operate.

To improve system performance and reduce resource usage.

To eliminate the vulnerability by changing system settings to a secure state.

To ensure compliance with internal naming conventions.

A vulnerability management program is mature, but the team is struggling with recurring vulnerabilities on developer workstations. The developers have local admin rights and often install unapproved software. The team has tried patching and scanning, but the issues persist. Which change to the program would most effectively address the root cause?

Implement a software inventory and application whitelisting policy, and remove local admin rights where possible.

Create a report showing the number of vulnerabilities on developer workstations.

Increase the frequency of vulnerability scans on developer workstations.

Move developers to a separate network segment.

GIAC Critical Controls Certification

Domain 5Objective 2

Continuous Vulnerability Management GCCC Practice Questions (Page 3)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11application · medium
A security team needs to scan a mix of internal servers and cloud workloads that are only reachable through a private network. The team wants to minimize the impact on production systems while still getting accurate results. Which scanning configuration is most appropriate?
Select an answer first
12expert · hard
A vulnerability management team has a remediation backlog. They have identified a vulnerability with a CVSS score of 7.5 on an internal file server that is not internet-facing, and a vulnerability with a CVSS score of 5.0 on an internet-facing web server that is known to be exploited in the wild. The team can only fix one this week. Which should they fix first?
Select an answer first
13foundation · easy
Which of the following is a key consideration when scheduling vulnerability scans across an enterprise?
Select an answer first
14foundation · easy
What is the primary goal of configuration changes as a remediation strategy?
Select an answer first
15expert · hard
A vulnerability management program is mature, but the team is struggling with recurring vulnerabilities on developer workstations. The developers have local admin rights and often install unapproved software. The team has tried patching and scanning, but the issues persist. Which change to the program would most effectively address the root cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Continuous Vulnerability Management GCCC Practice Questions (Page 3)

Questions 11–15

A security team needs to scan a mix of internal servers and cloud workloads that are only reachable through a private network. The team wants to minimize the impact on production systems while still getting accurate results. Which scanning configuration is most appropriate?

Which of the following is a key consideration when scheduling vulnerability scans across an enterprise?

What is the primary goal of configuration changes as a remediation strategy?

Keep studying — Security Operations and Monitoring