What does DNSSEC provide to protect against DNS-based attacks?

Digital signatures to verify the authenticity and integrity of DNS responses

A company's domain is being spoofed, and the security team wants to implement DMARC. The company sends marketing emails through a third-party service that uses a different sending domain. The team has published SPF and DKIM records for the main domain. Which DMARC policy should the team initially deploy to avoid disrupting legitimate email?

p=none with monitoring to identify all legitimate sending sources

p=reject immediately to stop spoofing

p=quarantine with a low spam score

p=reject with a policy override for the marketing service

What is the first step in responding to an email-based security incident?

Eradication to remove the threat

Lessons learned to improve future responses

Containment to prevent further spread or damage

A financial firm's analysts need to access third-party websites that are often compromised. The firm wants to ensure that any malicious code on those sites cannot execute on the analysts' workstations. Which solution best meets this requirement?

Use remote browser isolation so all web content executes in a cloud-hosted browser

Install a browser extension that blocks all JavaScript

Enable the browser's built-in pop-up blocker

Configure the browser to always use private browsing mode

A company wants to enforce a policy that blocks access to gambling sites. They have a web proxy that categorizes URLs, but some gambling sites use HTTPS and the proxy does not inspect HTTPS traffic. What is the most effective way to enforce the policy?

Block all HTTPS traffic to gambling sites by IP address.

Require users to use a specific browser that has a built-in gambling filter.

Deploy a secure web gateway that performs SSL/TLS inspection and URL categorization.

Use DNS filtering to block known gambling domains.

GIAC Critical Controls Certification

Domain 6Objective 2

Email and Web Browser Protections GCCC Practice Questions (Page 5)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

12concepts

Questions 21–25

21foundation · easy
What does DNSSEC provide to protect against DNS-based attacks?
Select an answer first
22expert · hard
A company's domain is being spoofed, and the security team wants to implement DMARC. The company sends marketing emails through a third-party service that uses a different sending domain. The team has published SPF and DKIM records for the main domain. Which DMARC policy should the team initially deploy to avoid disrupting legitimate email?
Select an answer first
23foundation · easy
What is the first step in responding to an email-based security incident?
Select an answer first
24application · medium
A financial firm's analysts need to access third-party websites that are often compromised. The firm wants to ensure that any malicious code on those sites cannot execute on the analysts' workstations. Which solution best meets this requirement?
Select an answer first
25expert · hard
A company wants to enforce a policy that blocks access to gambling sites. They have a web proxy that categorizes URLs, but some gambling sites use HTTPS and the proxy does not inspect HTTPS traffic. What is the most effective way to enforce the policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.