Secure Configuration of Enterprise Assets and Software GCCC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company wants to ensure that all servers in its asset inventory are covered by a security baseline. The inventory is maintained in a CMDB, but the security team suspects that some servers are missing from the CMDB. What is the best way to identify these missing servers and bring them under management?

   • AAsk server administrators to manually check whether their servers are in the CMDB.
   • BRun an active network discovery scan and compare the results to the CMDB, then add any unlisted servers to the inventory and apply the baseline.
   • CReview DHCP and DNS records to identify active servers.
   • DUse the configuration management tool's agent list as the authoritative inventory.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is a common hardening measure for software installations?

   • AUsing the same password for all administrative accounts
   • BEnabling all plugins and extensions
   • CGranting all users full control permissions
   • DRemoving or disabling default accounts and sample files
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company uses a configuration management tool to enforce a secure baseline on its web servers. Recently, a server was found to have an outdated version of Apache that is not in the baseline. The security team wants to automatically remediate this drift. What should they do?

   • AAdd the outdated Apache version to the baseline to avoid future alerts.
   • BUpdate the configuration management tool's playbook to include the correct Apache version and let it enforce the desired state.
   • CDisable the configuration management tool for that server to prevent it from reverting the change.
   • DManually update Apache on the affected server and document the change.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization maintains an asset inventory in a CMDB. The security team wants to ensure that only assets that are in the inventory receive secure configuration baselines. They also need to identify any asset that is not in the inventory but is connected to the network. Which integration approach best supports this requirement?

   • ARequire all employees to register their devices in the CMDB before connecting to the network.
   • BApply secure baselines to all assets that have an IP address, regardless of inventory status.
   • CUse network scanning tools to discover active assets and automatically reconcile them with the CMDB, flagging any asset not found in the inventory.
   • DExport the CMDB list and compare it to DHCP lease logs once a month.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is migrating its on-premises servers to a cloud provider. The security team has defined a secure baseline for the virtual machines. They want to ensure that any VM that is created from a custom image is automatically configured to the baseline and that any drift is corrected. Which approach is most effective?

   • AUse a script that runs once after the VM is created to apply the baseline.
   • BCreate a custom image with the baseline and manually configure any new VM that is created from it.
   • CApply the baseline to the image and rely on the cloud provider's default security settings.
   • DUse infrastructure-as-code templates that include the baseline configuration and integrate with a configuration management tool that enforces and remediates drift.
   Reveal Solution Discussion Select an answer first