Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software development company uses a popular web application framework. The security team wants to harden the framework's default configuration by disabling debug mode, setting secure cookie flags, and restricting file uploads. They also want to ensure these settings are applied consistently across all development, test, and production environments. Which approach is most effective?

   • AUse environment-specific configuration files that are only applied in production.
   • BModify the framework's default configuration file and copy it to each server using a USB drive.
   • CCreate a configuration template that is version-controlled and deployed via a configuration management tool to all environments.
   • DDocument the hardening settings in a wiki and ask developers to apply them manually in each environment.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it important to integrate secure configuration practices with asset inventory management?

   • ATo eliminate the need for separate vulnerability scanning tools
   • BTo ensure that all assets are covered by configuration baselines and that inventory records reflect current configurations
   • CTo restrict access to the asset inventory to only security personnel
   • DTo automatically purchase new hardware when assets are retired
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial services firm is required to demonstrate to auditors that all changes to firewall configurations are authorized, tested, and documented. The firm uses a change management system but currently has no link between firewall changes and the asset inventory. Which improvement best addresses the audit requirement?

   • AUse the firewall's built-in logging to record configuration changes and export logs monthly.
   • BRequire that every firewall change request include the asset tag of the affected firewall and update the asset inventory with the change reference.
   • CCreate a spreadsheet listing all firewall changes and email it to the audit team quarterly.
   • DTake a screenshot of the firewall configuration after each change and store it in a shared folder.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is preparing for an external audit that requires evidence of configuration changes to all network devices. The current process involves network engineers making changes directly on devices and documenting them in a shared spreadsheet. The audit team has already noted that the spreadsheet is often incomplete and lacks timestamps. Which change should the organization prioritize to meet audit requirements?

   • ARequire all configuration changes to be submitted through a change-management system that records the requester, approver, timestamp, and exact change details.
   • BIncrease the frequency of manual configuration backups and store them in a shared network folder.
   • CProvide additional training to network engineers on the importance of updating the spreadsheet after every change.
   • DImplement a read-only community string for SNMP monitoring to detect configuration changes automatically.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A government contractor must provide auditors with evidence that all servers are configured according to the CIS benchmarks. The contractor uses a configuration management tool to apply baselines. What should they implement to streamline audit evidence collection?

   • AExport the configuration management database to a CSV file annually for the audit.
   • BTake screenshots of the configuration management dashboard monthly and save them to a shared drive.
   • CProvide auditors with read-only access to the configuration management tool's live dashboard.
   • DEnable the configuration management tool's reporting feature to generate compliance reports on demand, and retain historical reports.
   Reveal Solution Discussion Select an answer first