Managing System Security GSLC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security manager is implementing a monitoring solution for a network that handles sensitive financial data. The solution must be able to detect anomalous behavior, such as a user accessing files at unusual times or from unusual locations. Which of the following is the most appropriate technology to deploy?

   • AUser and Entity Behavior Analytics (UEBA) that establishes a baseline of normal behavior and alerts on deviations.
   • BA firewall that blocks traffic based on IP addresses and ports.
   • CA vulnerability scanner that identifies missing patches and misconfigurations.
   • DA simple intrusion detection system (IDS) that only looks for known attack signatures.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security manager at a manufacturing company is responsible for patching a legacy industrial control system (ICS) that runs a critical production line. The vendor has released a security patch, but the patch has not been tested on the specific ICS version in use. The production line cannot be stopped during business hours, and a failed patch could cause a costly shutdown. The manager must decide how to proceed. What is the most appropriate action?

   • ADeploy the patch immediately to production to address the vulnerability, accepting the risk of a potential shutdown.
   • BTest the patch on a non-production replica of the ICS environment during the next maintenance window, then deploy it to production during the next scheduled downtime.
   • CDo not apply the patch and instead implement additional network segmentation and monitoring as compensating controls.
   • DApply the patch to a single production machine and monitor it for 24 hours before deploying to the rest of the fleet.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security manager is explaining the CIA triad to a new analyst. Which statement correctly describes the principle of availability?

   • ASystems and data are accessible to authorized users when needed.
   • BUsers are held accountable for their actions.
   • CData is accurate and has not been tampered with.
   • DData is protected from unauthorized disclosure.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of a security baseline in system hardening?

   • ATo eliminate all system vulnerabilities
   • BTo replace the need for patch management
   • CTo ensure all systems use the same hardware
   • DTo provide a consistent set of secure configuration standards for systems
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization is implementing a new electronic health record (EHR) system. The compliance team requires that only authorized clinicians can access patient records, and that each access is attributable to a specific individual. Which access control approach best meets these requirements?

   • AAssign each clinician a unique user account and implement role-based access control (RBAC) based on their job function.
   • BUse biometric authentication for all users but do not track which records they access.
   • CAllow all authenticated users to access all patient records to avoid delays in care.
   • DUse shared generic accounts for each department to simplify access management.
   Reveal Solution Discussion Select an answer first