Managing System Security GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key security consideration when decommissioning a system?

   • AEnsuring that all data is securely erased from storage media
   • BTransferring all user accounts to the new system
   • CRemoving the system from the network as quickly as possible
   • DDocumenting the system's hardware specifications
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of system monitoring and auditing?

   • ATo replace the need for incident response
   • BTo automatically patch all system vulnerabilities
   • CTo prevent all unauthorized access attempts
   • DTo detect suspicious activities and track system changes
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is it important to consider security during the procurement phase of a system's lifecycle?

   • ATo ensure the system is compatible with all existing hardware
   • BTo guarantee that the system will never require patching
   • CTo ensure that security requirements are included in the acquisition and that the system meets organizational security standards
   • DTo reduce the cost of the system by eliminating security features
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A government contractor is required to comply with NIST SP 800-171 for protecting controlled unclassified information (CUI). The contractor is planning to migrate some systems to a public cloud. What is the most important consideration for maintaining compliance?

   • ARequire the cloud provider to sign a contract stating they are fully responsible for all security controls.
   • BMove all CUI to the cloud and rely on the provider's security controls.
   • CEnsure the cloud provider is FedRAMP authorized and the contractor maintains responsibility for certain security controls.
   • DAvoid using the cloud entirely to avoid compliance issues.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security manager is reviewing the audit log strategy for a cloud-based application that processes personal data. The company must comply with a regulation that requires audit logs to be retained for 18 months and be available for immediate review by regulators. The current solution stores logs in a SIEM with a 30-day retention period. The manager must implement a solution that meets the retention requirement without exceeding the budget. Which approach is the most appropriate?

   • AReduce the log verbosity so that only critical events are logged, and retain those for 18 months in the SIEM.
   • BIncrease the SIEM's storage capacity to retain all logs for 18 months in the hot tier.
   • CExport logs to a local on-premises server at the end of each month and store them for 18 months.
   • DConfigure the SIEM to forward all logs to an object storage service with lifecycle policies that archive logs to cold storage after 30 days and retain them for 18 months.
   Reveal Solution Discussion Select an answer first