A large enterprise has an asset inventory that is maintained in a CMDB. The security team wants to ensure that all assets in the CMDB have a secure configuration baseline applied. However, some assets in the CMDB are outdated or decommissioned. What is the best way to handle this?

Reconcile the CMDB with actual discovered assets, and apply baselines only to assets that are confirmed active.

Apply baselines to all assets in the CMDB, including outdated ones, to ensure coverage.

Use the CMDB as the sole source of truth and apply baselines to every entry.

Remove all assets from the CMDB that do not have a baseline applied.

A company has 2,000 Linux servers that must comply with a CIS benchmark. The security team wants to automate the application of the benchmark and detect any drift from it. They already use Ansible for configuration management. Which approach aligns with automated enforcement and drift detection?

Manually configure each server using a checklist and run a weekly audit script to verify compliance.

Deploy a golden image with the CIS benchmark applied and reimage any server that drifts from the image.

Use Ansible to apply the CIS benchmark and integrate with a compliance scanning tool that reports drift and triggers remediation via Ansible.

Create an Ansible playbook that applies the CIS benchmark settings and schedule it to run every hour on all servers.

A security analyst is investigating a server that failed a compliance scan. The scan shows that the local security policy has been modified from the baseline. The analyst needs to determine whether the change was intentional and approved. Which source of information is most useful?

The change-management system's records for the server, including any approved change requests.

The server's uptime and reboot history.

The configuration management tool's last enforcement run log.

The server's event logs showing when the policy was modified.

A manufacturing company has a mix of Windows servers and Linux servers. They want to enforce a secure configuration baseline for both operating systems using a single tool. They also need to track changes and integrate with their existing asset inventory. Which tool is best suited for this?

Use a shell script for Linux and a PowerShell script for Windows, both run manually.

Use Windows Group Policy for Windows servers and a separate Linux configuration tool for Linux servers.

Use a configuration management database to store configurations but apply them manually.

Use Ansible with playbooks for both Windows and Linux, and integrate with the CMDB via API.

A company deploys a new web application that uses a database. The security team wants to harden the database configuration by disabling default accounts, setting strong authentication, and restricting network access. They also want to ensure these settings are applied consistently across all database instances. Which approach is most effective?

Manually configure each database instance and document the settings in a runbook.

Apply the hardening settings only to production databases to avoid disrupting development.

Use the database's default configuration and rely on the network firewall to protect it.

Create a database configuration template that is applied via an automated configuration management tool.

GIAC Critical Controls Certification

Domain 2Objective 3

Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 1)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 1–5

1expert · hard
A large enterprise has an asset inventory that is maintained in a CMDB. The security team wants to ensure that all assets in the CMDB have a secure configuration baseline applied. However, some assets in the CMDB are outdated or decommissioned. What is the best way to handle this?
Select an answer first
2application · medium
A company has 2,000 Linux servers that must comply with a CIS benchmark. The security team wants to automate the application of the benchmark and detect any drift from it. They already use Ansible for configuration management. Which approach aligns with automated enforcement and drift detection?
Select an answer first
3application · medium
A security analyst is investigating a server that failed a compliance scan. The scan shows that the local security policy has been modified from the baseline. The analyst needs to determine whether the change was intentional and approved. Which source of information is most useful?
Select an answer first
4application · medium
A manufacturing company has a mix of Windows servers and Linux servers. They want to enforce a secure configuration baseline for both operating systems using a single tool. They also need to track changes and integrate with their existing asset inventory. Which tool is best suited for this?
Select an answer first
5application · medium
A company deploys a new web application that uses a database. The security team wants to harden the database configuration by disabling default accounts, setting strong authentication, and restricting network access. They also want to ensure these settings are applied consistently across all database instances. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.