Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which type of tool is commonly used to automatically enforce secure configurations on enterprise assets?

   • ANetwork intrusion detection systems (NIDS)
   • BData loss prevention (DLP) tools
   • CConfiguration management tools such as Ansible, Chef, or Puppet
   • DEmail security gateways
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A hospital's IT team must standardize Windows 10 workstations used by nurses. They need to enforce a common security baseline that includes disabling USB mass storage, enabling BitLocker, and restricting local administrator rights. The team wants to ensure that any deviation from this baseline is automatically corrected within 24 hours. Which approach best meets these requirements?

   • ACreate a Group Policy Object (GPO) with the required settings, link it to the workstation OU, and configure a scheduled task to run gpupdate /force nightly.
   • BDeploy a configuration management tool (e.g., Microsoft Intune or SCCM) that applies the baseline and continuously evaluates compliance, automatically remediating non-compliant settings.
   • CDistribute a PowerShell script to each workstation that applies the settings once during imaging, and rely on the local security policy to maintain them.
   • DManually configure each workstation using the Security Configuration Wizard and document the settings in a spreadsheet for audit purposes.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A cloud-native company runs its production workloads on Kubernetes. The security team has defined a Pod Security Standard baseline that restricts privileged containers and enforces read-only root filesystems. They need to detect any pod that violates this baseline and automatically prevent it from running. Which tool/approach should they implement?

   • AConfigure Kubernetes namespaces with labels and rely on RBAC to restrict who can create pods.
   • BEnable Kubernetes audit logging and review logs weekly for privileged pods.
   • CRun a nightly script that scans running pods and flags any that do not match the baseline.
   • DUse an admission controller like OPA/Gatekeeper that validates pod specifications against the baseline and rejects non-compliant pods.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company deploys a third-party application that requires a specific configuration that conflicts with the company's secure baseline. The application vendor states that the configuration is necessary for the application to function. The security team must decide how to proceed. What is the most appropriate action?

   • AChange the baseline to accommodate the application without further review.
   • BDeploy the application and ignore the conflict, hoping it does not cause issues.
   • CRefuse to deploy the application because it violates the baseline.
   • DDocument the exception, assess the risk, and implement compensating controls if necessary.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An organization uses a configuration management tool to enforce a security baseline on all servers. However, a recent audit found that some servers have drifted from the baseline because administrators disabled certain settings to troubleshoot issues. The organization wants to maintain the ability to troubleshoot while ensuring that the baseline is eventually restored. Which approach is most effective?

   • ADisable the configuration management tool on servers that require frequent troubleshooting.
   • BRequire administrators to manually reapply the baseline after troubleshooting.
   • CImplement a policy that allows temporary exceptions with a defined expiration, after which the configuration management tool automatically re-enforces the baseline.
   • DIncrease the frequency of drift detection scans to every hour.
   Reveal Solution Discussion Select an answer first