A security team is setting up vulnerability scanning for a new office subnet that contains both Windows workstations and Linux servers. The team wants to minimize disruption to production systems while still getting accurate results. Which scanning configuration is most appropriate?

Use passive scanning only to avoid any impact on production.

Scan only the Linux servers because they are more critical.

Run an unauthenticated scan during business hours to avoid authentication issues.

Run an authenticated scan during the maintenance window using dedicated scan credentials.

A company has a mix of always-on servers and remote laptops. The security team wants continuous vulnerability coverage for both, but network-based scanning cannot reach the laptops when they are off VPN. Which approach best meets the requirement?

Use agent-based scanning on the laptops and network-based scanning on the servers.

Use only network-based scanning on all devices.

Use passive scanning on the network and rely on VPN logs for laptops.

Use only agent-based scanning on all devices.

A company has a mature vulnerability management program that scans weekly. However, the team notices that some vulnerabilities reappear after being remediated. What is the most likely cause and what should they do?

The scan schedule is too frequent and is causing system instability.

The team should switch to a different scanner to get different results.

The scanner is producing false positives that should be ignored.

The remediation process is not verified with a follow-up scan, and the same vulnerability is being reintroduced by configuration drift.

After remediating a set of vulnerabilities, a security team wants to ensure that the fixes are effective and that no new vulnerabilities were introduced. What should they do?

Wait for the next quarterly scan to see if the findings disappear.

Run a follow-up authenticated scan on the affected systems and compare results to the baseline.

Close the findings in the vulnerability management system without verification.

Review the patch management logs only.

A vulnerability management team wants to communicate to senior management that the organization's risk is decreasing, even though the total number of open vulnerabilities has increased. Which metric should they present?

Total number of open vulnerabilities.

Number of critical vulnerabilities on internet-facing systems that remain open past the SLA.

Average time to remediate all vulnerabilities.

Number of scans performed this quarter.

GIAC Critical Controls Certification

Domain 5Objective 2

Continuous Vulnerability Management GCCC Practice Questions (Page 5)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21application · medium
A security team is setting up vulnerability scanning for a new office subnet that contains both Windows workstations and Linux servers. The team wants to minimize disruption to production systems while still getting accurate results. Which scanning configuration is most appropriate?
Select an answer first
22expert · hard
A company has a mix of always-on servers and remote laptops. The security team wants continuous vulnerability coverage for both, but network-based scanning cannot reach the laptops when they are off VPN. Which approach best meets the requirement?
Select an answer first
23expert · hard
A company has a mature vulnerability management program that scans weekly. However, the team notices that some vulnerabilities reappear after being remediated. What is the most likely cause and what should they do?
Select an answer first
24application · medium
After remediating a set of vulnerabilities, a security team wants to ensure that the fixes are effective and that no new vulnerabilities were introduced. What should they do?
Select an answer first
25application · medium
A vulnerability management team wants to communicate to senior management that the organization's risk is decreasing, even though the total number of open vulnerabilities has increased. Which metric should they present?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.