Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team is responsible for a fleet of 10,000 endpoints. They have a configuration baseline that includes specific registry settings and file permissions. They need to detect drift, but they also need to avoid overwhelming the help desk with false positives. They have decided to use a configuration management tool that can report drift. Which reporting strategy best balances detection and operational burden?

   • AConfigure the tool to automatically remediate any drift and generate a report only when remediation fails.
   • BUse a file integrity monitoring tool that alerts on any change to the registry or files.
   • CDisable drift detection and rely on periodic manual audits.
   • DGenerate a daily report of all drift and send it to the help desk for manual review.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's change-management board has approved a configuration change to a critical application server. The change is scheduled for the next maintenance window. The security team wants to ensure that the change is implemented exactly as approved and that any unintended changes are rolled back. Which practice best supports this?

   • ATake a full backup of the server before the change and restore it if any issue is noticed within a week.
   • BSchedule a second change to reverse the first change if problems occur.
   • CUse a configuration management tool to apply the approved change and then run a drift detection scan to compare the server's configuration to the approved baseline.
   • DHave the change implemented manually by a senior administrator and then document the change in the change log.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A university manages thousands of endpoints across multiple departments. The security team wants to ensure that only assets listed in the official asset inventory receive configuration baselines, and that any new asset is automatically onboarded to the configuration management system. Which approach best achieves this integration?

   • AApply baselines to all assets on the network regardless of inventory status.
   • BUse an asset discovery tool that feeds the CMDB, and configure the configuration management tool to pull new assets from the CMDB and apply baselines automatically.
   • CUse a network scanner to identify assets and then manually update the CMDB monthly.
   • DManually add new assets to the configuration management tool when they are purchased.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the first step in remediating configuration drift?

   • ADisabling the asset from the network
   • BDetecting that the asset's configuration no longer matches the baseline
   • CUpdating the baseline to match the current configuration
   • DRebuilding the asset from scratch
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is deploying a new web application on a Linux server. The application requires a specific version of a third-party library that has known vulnerabilities. The security team must harden the software installation while ensuring the application remains functional. Which action is the most appropriate?

   • AInstall the vulnerable library but disable all unnecessary modules and features of the application.
   • BUse a container image that includes the vulnerable library and isolate it from the rest of the network.
   • CInstall the required library version and apply additional hardening measures such as running the application with the least privileges and enabling a web application firewall.
   • DRefuse to deploy the application until the library is updated to a patched version.
   Reveal Solution Discussion Select an answer first