A company wants to reduce the risk of malware infections from email attachments and unpatched software. Which combination of controls provides a layered defense?

Email gateway filtering, endpoint antivirus, and a patch management program

Network firewall and intrusion detection system

Which combination best represents a layered defense approach against malware?

Intrusion detection, log analysis, and backup

Endpoint protection, network controls, and user awareness

Patch management, vulnerability scanning, and penetration testing

Firewall, antivirus, and encryption

How does application whitelisting help prevent malware infections?

By patching vulnerabilities automatically

By isolating suspicious files in a sandbox

By detecting malware signatures in real time

By blocking all software except approved applications

A hospital's clinical workstations run a fixed set of approved medical applications. The security team wants to prevent unauthorized executables from running, including malware that evades signature detection. Which control is most appropriate for this environment?

Increase user training on recognizing phishing emails.

Deploy application whitelisting that allows only approved executables and scripts.

Enable heuristic detection on the existing antivirus product.

Configure the firewall to block all outbound traffic from workstations.

A company wants to prevent employees from running unauthorized executables on their Windows workstations. They have a standard set of approved applications. Which control is most effective for this requirement?

Network firewall that blocks all inbound traffic.

Signature-based antivirus that scans all downloaded files.

Application whitelisting that only allows approved executables to run.

User education on the dangers of downloading unknown software.

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 7)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 31–35

31application · medium
A company wants to reduce the risk of malware infections from email attachments and unpatched software. Which combination of controls provides a layered defense?
Select an answer first
32foundation · easy
Which combination best represents a layered defense approach against malware?
Select an answer first
33foundation · easy
How does application whitelisting help prevent malware infections?
Select an answer first
34application · medium
A hospital's clinical workstations run a fixed set of approved medical applications. The security team wants to prevent unauthorized executables from running, including malware that evades signature detection. Which control is most appropriate for this environment?
Select an answer first
35application · medium
A company wants to prevent employees from running unauthorized executables on their Windows workstations. They have a standard set of approved applications. Which control is most effective for this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.