What is a primary advantage of passive vulnerability scanning compared to active scanning?

It can scan systems that are completely isolated from the network.

It provides more accurate results because it directly interrogates each system.

It can detect vulnerabilities without sending packets that might disrupt the target system.

It requires no network access to the target systems.

Which action is an example of a compensating control for a vulnerability that cannot be patched immediately?

Upgrading the operating system to a newer version.

Documenting the vulnerability in the risk register without any action.

Applying a vendor-supplied security patch.

Disabling the vulnerable service or feature.

Which sequence best represents the continuous vulnerability management lifecycle as defined by the Critical Controls?

Identify, remediate, classify, mitigate, and then move on to other security tasks.

Scan once, remediate all findings, and then stop because the environment is secure.

Mitigate, remediate, classify, identify, and then archive the results permanently.

Identify, classify, remediate, mitigate, and then repeat the cycle continuously.

Which scanning technique is best suited for discovering vulnerabilities on systems that are not always connected to the network?

Agent-based scanning installed on each endpoint.

External scanning from the internet.

Active scanning from a central server.

Passive scanning by monitoring network traffic.

What is the primary purpose of a vulnerability management report to executive stakeholders?

To justify the purchase of additional scanning licenses.

To assign blame to specific teams for failing to patch systems.

To provide a detailed technical list of every vulnerability and its CVE ID.

To communicate overall risk posture and trends in a business-friendly manner.

GIAC Critical Controls Certification

Domain 5Objective 2

Continuous Vulnerability Management GCCC Practice Questions (Page 8)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
What is a primary advantage of passive vulnerability scanning compared to active scanning?
Select an answer first
37foundation · easy
Which action is an example of a compensating control for a vulnerability that cannot be patched immediately?
Select an answer first
38foundation · easy
Which sequence best represents the continuous vulnerability management lifecycle as defined by the Critical Controls?
Select an answer first
39foundation · easy
Which scanning technique is best suited for discovering vulnerabilities on systems that are not always connected to the network?
Select an answer first
40foundation · easy
What is the primary purpose of a vulnerability management report to executive stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.