Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An organization is preparing for an external audit. The auditor requests evidence that configuration changes are controlled and that drift is monitored. The organization has a configuration management tool that logs changes and can report drift. However, the auditor wants to see that changes are approved before implementation. What should the organization provide?

   • AA log of all configuration changes exported from the tool.
   • BA policy document stating that all changes must be approved.
   • CA screenshot of the configuration management tool's dashboard showing current compliance.
   • DA report from the configuration management tool showing the change history and a separate document showing the approval workflow for each change.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team has defined a secure configuration baseline for Windows 10 workstations that includes disabling legacy authentication protocols and enforcing specific Windows Defender settings. They need to ensure that all 5,000 workstations in the domain receive this baseline and that any deviation is corrected within 24 hours. The team currently uses Group Policy for some settings but wants a more automated and continuous enforcement mechanism. Which approach best meets the requirement?

   • AExport the baseline as a Group Policy object and link it to the domain, then rely on the next Group Policy refresh cycle to apply changes.
   • BDeploy the baseline via Group Policy and schedule a weekly compliance report using Microsoft Defender for Endpoint.
   • CUse Microsoft Intune to assign the security baseline to all workstations and enable automatic remediation for settings that drift from the baseline.
   • DCreate a PowerShell script that applies the baseline settings and run it manually on each workstation during the next maintenance window.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An organization uses a configuration management tool to enforce a security baseline on all servers. However, some servers require different settings due to their role (e.g., web servers need a specific port open). The current tool applies the same baseline to all servers, causing compliance failures. The security team wants to maintain a common security baseline while allowing role-specific exceptions. Which approach is most effective?

   • AUse the same baseline for all servers and ignore compliance failures for servers that need exceptions.
   • BCreate a separate baseline for each server role and apply them manually.
   • CDefine a common baseline and use role-based profiles that extend or override specific settings, with the tool enforcing the appropriate profile for each server.
   • DRemove the conflicting settings from the common baseline so all servers pass.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization is required to maintain an accurate inventory of all devices that access patient data. They use a configuration management tool to apply baselines. How can they ensure that only devices in the inventory receive baselines and that the inventory is kept up to date?

   • AIntegrate the configuration management tool with the asset discovery tool so that only discovered assets are added to the inventory and baselined.
   • BManually review the inventory quarterly and add new devices to the configuration management tool.
   • CAllow any device that connects to the network to receive a baseline automatically.
   • DUse the configuration management tool to discover devices and automatically add them to the inventory.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How does asset inventory data support secure configuration management?

   • ABy automatically patching all software vulnerabilities
   • BBy replacing the need for configuration baselines
   • CBy blocking unauthorized devices from the network
   • DBy identifying which assets exist and their characteristics, so appropriate baselines can be applied
   Reveal Solution Discussion Select an answer first