Security Frameworks and CIS Controls GSEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A small business with limited IT staff wants to improve its security posture by implementing a prioritized set of actions that address the most common attacks. Which approach aligns best with this goal?

   • AAdopt the CIS Controls, starting with Implementation Group 1 (IG1) controls.
   • BImplement all 18 CIS Controls at once to ensure comprehensive coverage.
   • CWait for a security breach to occur before implementing any security measures.
   • DFocus only on purchasing the latest security technology without a structured plan.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A security consultant is helping a client implement the CIS Controls. The client has a small IT team and limited budget. The consultant recommends starting with the Basic controls. Which of the following is a Basic control that the client should implement first?

   • AInventory and Control of Software Assets
   • BIncident Response Management
   • CSecurity Awareness and Skills Training
   • DContinuous Vulnerability Management
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is explaining the CIS Controls to a new hire. The analyst wants to emphasize that the controls are organized into categories based on their function. Which statement accurately describes the categories?

   • ABasic controls focus on inventory and configuration, Foundational controls focus on ongoing defenses, and Organizational controls focus on people and processes.
   • BBasic controls are technical, Foundational controls are administrative, and Organizational controls are physical.
   • CBasic controls are optional, Foundational controls are required, and Organizational controls are recommended.
   • DBasic controls are for small organizations, Foundational controls are for medium organizations, and Organizational controls are for large organizations.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An organization wants to use a security framework to guide its security program. Which of the following is a key benefit of applying a framework like the CIS Controls?

   • AIt guarantees compliance with all legal and regulatory requirements.
   • BIt eliminates the need for ongoing security monitoring and updates.
   • CIt automatically implements all security controls without human intervention.
   • DIt provides a common language and structure for discussing and improving security.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small business owner is reading about the CIS Controls and asks their IT consultant, 'Why should we use these controls?' Which response best reflects the purpose of the CIS Controls?

   • AThey provide a prioritized set of actions to mitigate the most common cyber attacks.
   • BThey guarantee that a business will not be hacked.
   • CThey are a one-time security assessment tool.
   • DThey are required by law for all businesses.
   Reveal Solution Discussion Select an answer first