System Security Management GCIP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A mid-sized engineering firm has a small IT team and wants to ensure that no single administrator has excessive privileges. They are implementing a new access control policy. Which approach best enforces least privilege and separation of duties?

   • AGrant all IT staff domain administrator rights for convenience
   • BCreate role-based access control (RBAC) roles with only the permissions needed for each job function
   • CUse a single shared administrator account for all IT staff
   • DReview user accounts only when an employee leaves the company
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A logistics company has a fleet of delivery vehicles with onboard computers that connect to a central dispatch system. The security team wants to detect anomalous behavior, such as unusual network connections or unauthorized software. Which monitoring approach is most effective for these endpoints?

   • ADeploy an endpoint detection and response (EDR) agent that sends alerts to a central security operations center (SOC)
   • BUse a network intrusion detection system (NIDS) at the central dispatch office only
   • CConfigure the onboard computers to send logs to a syslog server without any alerting
   • DEnable Windows Event Logging and review logs weekly
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   During a security assessment of a critical server, the analyst runs a port scan and finds that the server is listening on TCP port 3389. Which service is most likely running on this port?

   • AFile Transfer Protocol (FTP)
   • BSecure Shell (SSH)
   • CHypertext Transfer Protocol (HTTP)
   • DRemote Desktop Protocol (RDP)
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial institution is required by regulation to retain audit logs for at least one year. The security team is configuring logging for a critical database server. What is the most important consideration to ensure the logs meet the retention requirement?

   • AConfigure log rotation and archival to a secure, centralized storage system with a one-year retention policy.
   • BEnable verbose logging for all events to ensure no security event is missed.
   • CStore logs in a compressed format on the same server to save space.
   • DSet the log size to a large value and rely on the server's local disk to store logs for a year.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A chemical plant's security team is setting up monitoring for a critical process control network. They want to detect a potential denial-of-service attack or a misconfigured device that is flooding the network. Which monitoring approach is most effective for this purpose?

   • AEnable SNMP traps on all devices and review them weekly.
   • BMonitor network traffic baselines and set alerts for significant deviations in bandwidth or packet rates.
   • CMonitor only authentication logs for failed login attempts.
   • DInstall antivirus software on all devices and monitor for malware alerts.
   Reveal Solution Discussion Select an answer first