Security Frameworks and CIS Controls GSEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following CIS Controls is classified as an Organizational control?

   • ASecure Configuration of Enterprise Assets and Software
   • BInventory and Control of Enterprise Assets
   • CIncident Response Management
   • DContinuous Vulnerability Management
   Reveal Solution Discussion Select an answer first
2. 12expert · medium · select all that apply

   A small business is implementing the CIS Controls and wants to focus on the controls that mitigate the most common attacks. Which of the following controls are part of the CIS Controls' Basic category? Select all that apply.

   • AData Protection
   • BSecure Configuration of Enterprise Assets and Software
   • CInventory and Control of Hardware Assets
   • DContinuous Vulnerability Management
   • EAccount Management
   Check answers Discussion Select an answer first
4. 13application · medium

   A large financial institution with a dedicated security team and a high-risk profile is implementing the CIS Controls. They have already completed IG1 and IG2 controls and are now considering IG3. Which additional capability is most characteristic of IG3?

   • ACreating a basic asset inventory of hardware and software.
   • BImplementing advanced security measures such as penetration testing and red team exercises.
   • CEstablishing a security awareness training program for employees.
   • DImplementing a firewall and antivirus software on all endpoints.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which CIS Implementation Group is appropriate for an organization that has moderate resources and needs to implement additional controls to protect against more sophisticated threats?

   • AIG2
   • BIG3
   • CIG1
   • DIG4
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A community college with a small IT staff wants to improve its security posture against the most common attacks, such as phishing and web-based exploits. They have limited budget and cannot implement all 18 CIS Controls immediately. Which approach aligns with the purpose of the CIS Controls?

   • AImplement only the Organizational controls because they cover governance and policy.
   • BImplement the controls in order of priority, starting with the ones that mitigate the most common attacks.
   • CWait until the college can afford a full security team before implementing any controls.
   • DSelect controls randomly to avoid predictability by attackers.
   Reveal Solution Discussion Select an answer first