System Security Management GCIP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of deprovisioning a user account when an employee leaves the organization?

   • ATo free up storage space in the user database
   • BTo allow the employee to continue accessing non-sensitive systems
   • CTo maintain a record of the employee's activity
   • DTo revoke access to systems and data
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A power generation company has a team of engineers who need access to the turbine control system. The security team wants to enforce separation of duties so that no single engineer can both modify control logic and approve the change. What is the best approach?

   • AAllow engineers to modify the system but require them to document changes in a logbook.
   • BGive all engineers full administrative access and rely on audit logs to detect unauthorized changes.
   • CCreate two separate roles: 'Control Engineer' with modify permissions and 'Change Approver' with approve permissions, and assign users to only one role.
   • DUse a shared administrator account for all engineers to simplify management.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A manufacturing plant runs a legacy SCADA workstation that must remain available 24/7. A recent vulnerability scan showed that the workstation has several open ports and services that are not required for its function. The plant's change-control policy requires that any change be tested and approved, but the workstation cannot be taken offline during production hours. What is the most appropriate first step to reduce the attack surface while maintaining availability?

   • ADocument the findings, schedule a maintenance window, and test the disabling of each unnecessary service and port before applying it to production.
   • BIncrease logging and alerting for the open ports and services to detect any malicious activity.
   • CDisable the unnecessary services and block the open ports using the host-based firewall immediately.
   • DApply the vendor's latest firmware update, which is known to close those ports by default.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a security-relevant event that should trigger an alert?

   • AA scheduled backup completing successfully
   • BA user printing a document
   • CA user changing their desktop wallpaper
   • DMultiple failed login attempts followed by a successful login
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A financial trading firm is required to retain audit logs for seven years. The logs are stored on a centralized log server. The security team discovers that the log server's disk is filling up quickly and logs are being overwritten before the retention period. What is the most appropriate action?

   • AIncrease the disk size of the log server to accommodate more logs.
   • BDelete logs older than one year to free up space.
   • CReduce the logging verbosity to decrease the log volume.
   • DImplement log rotation and archival to a low-cost, long-term storage solution such as tape or cold cloud storage.
   Reveal Solution Discussion Select an answer first