System Security Management GCIP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized manufacturing company has a patch management process that deploys updates to all servers on the first Tuesday of every month. A critical zero-day vulnerability is announced for a widely used application on the 15th of the month. What should the patch management team do?

   • AEvaluate the risk, test the patch in a staging environment, and deploy it using an emergency change process if the risk is high.
   • BWait for the next scheduled patch cycle to avoid disrupting production.
   • CApply the patch only to internet-facing servers and defer internal servers to the next cycle.
   • DDeploy the emergency patch immediately to all servers without testing.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A hospital's IT department manages user accounts for clinical staff. A nurse has been promoted to a supervisory role and now needs access to additional patient records. The security team wants to ensure that the nurse's previous access is reviewed and that the new access is granted with least privilege. What is the best approach?

   • AAdd the nurse to the supervisor role and leave the existing permissions unchanged.
   • BReview the nurse's current access, remove any permissions not needed for the new role, and grant only the necessary supervisor permissions.
   • CCreate a new account for the nurse with supervisor permissions and disable the old account.
   • DGrant the nurse full administrative access to all patient records to avoid future requests.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A natural gas utility has a remote terminal unit (RTU) that communicates with a central SCADA system. The RTU has a web interface for configuration that is not needed for normal operations. The security team wants to reduce the attack surface but must maintain remote access for maintenance. Which action is most appropriate?

   • AChange the web interface port to a non-standard port
   • BKeep the web interface enabled but restrict access to specific IP addresses
   • CApply the latest firmware patch to the RTU
   • DDisable the web interface and use a secure VPN for remote maintenance access
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A regional airport's security team is monitoring a critical baggage handling system. The system generates a large number of events, and the team is concerned about missing a real security incident among the noise. They have a SIEM but it is not tuned. What is the most effective way to improve detection without overwhelming the analysts?

   • AForward all logs to a second SIEM for redundancy.
   • BDisable alerts for low-severity events and only alert on critical events.
   • CIncrease the alert threshold for all event types to reduce the number of alerts.
   • DCreate correlation rules that combine multiple low-severity events into a single high-severity alert.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A chemical plant has a distributed control system (DCS) with multiple controllers. The security team wants to implement monitoring and alerting, but the controllers have limited processing power and cannot run agents. Which approach is most appropriate?

   • AInstall a lightweight agent on each controller
   • BUse the controllers' built-in logging and review logs manually
   • CReplace the controllers with newer models that support agents
   • DDeploy a passive network monitoring solution that analyzes traffic to the controllers
   Reveal Solution Discussion Select an answer first