What is the primary goal of a configuration management process?

To track and manage changes to assets and software in a controlled manner

To replace the need for asset inventory by tracking only software versions

To automatically roll back all configuration changes after a set period

To prevent any configuration changes from ever being made

A software development team is deploying a Java application to a production server. The application requires a specific version of a library that has a known remote code execution vulnerability. The vendor has not yet released a patch. The security team must reduce the risk while keeping the application available. Which combination of actions is most appropriate?

Apply a virtual patch using a web application firewall or intrusion prevention system, and restrict network access to the application to only necessary sources.

Disable the application until the vendor releases a patch.

Increase logging and monitoring of the application without making any configuration changes.

Remove the vulnerable library and replace it with a different library that has similar functionality.

Which of the following best describes how a secure configuration baseline should be applied to enterprise assets?

As a one-time activity during initial deployment

Only to assets that store sensitive data

Consistently across all assets of the same type, with exceptions documented and approved

Only to servers and network devices, not endpoints

Why is it important for secure configurations to support audit evidence collection?

To hide configuration details from unauthorized users

To demonstrate compliance with policies and regulations during audits

To automatically generate new configuration baselines

To replace the need for regular vulnerability scans

What type of information is typically required as audit evidence for secure configurations?

Marketing materials and product documentation

Network traffic logs from all users

Records of configuration changes, approvals, and baseline compliance checks

Personal information of all employees

GIAC Critical Controls Certification

Domain 2Objective 3

Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 4)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 16–20

16foundation · easy
What is the primary goal of a configuration management process?
Select an answer first
17application · medium
A software development team is deploying a Java application to a production server. The application requires a specific version of a library that has a known remote code execution vulnerability. The vendor has not yet released a patch. The security team must reduce the risk while keeping the application available. Which combination of actions is most appropriate?
Select an answer first
18foundation · easy
Which of the following best describes how a secure configuration baseline should be applied to enterprise assets?
Select an answer first
19foundation · easy
Why is it important for secure configurations to support audit evidence collection?
Select an answer first
20foundation · easy
What type of information is typically required as audit evidence for secure configurations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.