Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has a mix of Windows and Linux servers. They want to define a secure configuration baseline that includes password policies, audit logging, and disabling unnecessary services. They also want to enforce this baseline automatically. Which approach is most appropriate?

   • ADefine the baseline in a document and rely on administrators to follow it.
   • BCreate separate baselines for Windows and Linux and apply them manually.
   • CUse Group Policy for Windows and a shell script for Linux, both run at boot.
   • DUse a configuration management tool that supports both operating systems and define the baseline as code.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government agency must provide auditors with evidence that all workstations are configured according to a mandated security baseline. The agency has a mix of Windows and macOS devices. Which approach provides the most comprehensive audit evidence?

   • AUse separate tools for Windows and macOS and manually combine the reports.
   • BPerform a one-time audit of a sample of devices.
   • CUse a unified endpoint management tool that collects configuration data from both platforms and generates compliance reports with timestamps.
   • DAsk each user to confirm that their device is configured correctly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital is deploying 500 new Windows 10 workstations for clinical staff. The security team has a security baseline that includes disk encryption, screen lock timeout, and disabling removable media. They want to ensure that every workstation is compliant before it is connected to the network. Which approach is most efficient?

   • AConnect all workstations to the network first, then push the baseline via Group Policy and hope it applies before users log in.
   • BInstall the workstations with default settings and rely on the antivirus software to protect them until the baseline is applied.
   • CProvide a checklist to the IT technician and have them manually configure each workstation before connecting it.
   • DUse a deployment tool that applies the security baseline during imaging and verifies compliance before allowing network access.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company uses a configuration management tool to enforce baselines on its servers. The tool runs every hour and automatically remediates any drift. However, some servers have applications that require specific configuration changes that are not in the baseline. These changes are being reverted by the tool, causing application outages. How should the security team handle this conflict?

   • AAdd the application-specific configurations to the baseline as exceptions, and document the business justification.
   • BExclude those servers from the configuration management tool to prevent disruption.
   • CChange the baseline to match the application's configuration requirements.
   • DDisable automatic remediation and only report drift for manual review.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multinational company must comply with GDPR and PCI DSS. They have offices in the EU and the US. The security team is defining a secure configuration baseline for laptops. Which consideration is most important when defining the baseline?

   • AEnsure the baseline includes full-disk encryption and a policy that prevents data from being stored on unencrypted removable media.
   • BFocus only on network security settings because GDPR and PCI DSS primarily concern data in transit.
   • CUse the same baseline for all laptops regardless of region to simplify management.
   • DExclude encryption from the baseline because it is not explicitly required by GDPR or PCI DSS.
   Reveal Solution Discussion Select an answer first