System Security Management GCIP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A power utility has a security operations center (SOC) that monitors a large number of industrial control systems. The SOC receives thousands of alerts daily, but many are false positives. The team wants to improve the signal-to-noise ratio without missing real incidents. They have limited staff and cannot manually review every alert. What is the most effective approach?

   • AIncrease the logging verbosity on all systems to capture more data for analysis.
   • BImplement a security information and event management (SIEM) system with correlation rules and alert tuning based on known-good baselines.
   • CDisable all alerts except for critical severity events to reduce noise.
   • DHire more analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A utility company's security team is configuring logging for a set of critical industrial control system (ICS) servers. They need to ensure that logs are available for forensic investigation after a security incident, but the servers have limited local storage. What is the best approach?

   • ASend logs to a cloud-based logging service without encryption to save bandwidth.
   • BEnable logging only for authentication events to reduce the volume of logs.
   • CStore logs only locally on each server and increase the local disk size to accommodate a year of logs.
   • DConfigure syslog forwarding to a centralized, hardened log server with write-once storage and set appropriate retention periods.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of multi-factor authentication (MFA)?

   • ATo eliminate the need for passwords
   • BTo require two or more independent credentials to verify identity
   • CTo simplify the login process for users
   • DTo ensure only administrators can access systems
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A hospital's clinical engineering department manages a fleet of medical devices running a legacy operating system that is no longer supported by the vendor. The devices are critical for patient care and cannot be replaced immediately. What is the most appropriate mitigation strategy?

   • ADisable the devices' network interfaces to prevent any remote access.
   • BUpgrade the operating system to a newer version without vendor approval.
   • CIsolate the devices on a separate network segment and restrict communication to only the required systems.
   • DInstall the latest antivirus software on each device and schedule daily scans.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A power utility's security team is configuring logging on a critical substation controller. They need to ensure that logs are available for forensic analysis after a security incident, but the controller has limited storage. Which logging configuration best meets this requirement?

   • AStream logs to a central log management system with write-once, read-many (WORM) storage
   • BSend logs to a syslog server without any retention policy
   • CStore logs locally on the controller and overwrite when full
   • DDisable logging for routine events to save storage space
   Reveal Solution Discussion Select an answer first