Managing System Security GSLC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A hospital's IT department manages a mix of Windows servers, Linux servers, and medical devices. A critical vulnerability has been announced for a third-party application used on some Windows servers. The vendor has released a patch, but the hospital's change advisory board (CAB) requires that all patches be tested for at least two weeks before deployment to avoid disrupting patient care. However, the vulnerability is being actively exploited in the wild. The security team must decide how to proceed. What is the best course of action?

   • AExpedite the testing process by focusing on the affected servers and deploy the patch as soon as testing is complete, while implementing temporary mitigations in the meantime.
   • BDisconnect the affected servers from the network until the patch is deployed.
   • CDeploy the patch immediately to all affected servers without testing to eliminate the vulnerability as quickly as possible.
   • DWait the full two-week testing period to comply with the CAB policy, then deploy the patch.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A regional bank must patch a critical remote-code-execution vulnerability in its internet-facing web application server. The vulnerability was disclosed 48 hours ago, and exploit code is already circulating. The bank's change advisory board (CAB) normally requires a 2-week testing cycle for all production changes, and the application team wants to run the full regression suite before deploying. The bank's compliance team has confirmed that the current control environment is adequate for a temporary exception. What is the most appropriate action for the security manager to take?

   • AApply the patch to a staging environment, run the full regression suite, and then deploy to production only after the CAB approves the change at its next scheduled meeting.
   • BWait for the full 2-week regression cycle to complete to avoid any application instability, and rely on the web application firewall (WAF) as a compensating control.
   • CAsk the application team to manually apply the patch to the production server outside of the change management system to avoid any delay.
   • DDeploy the patch immediately to production, then run the regression suite in parallel and document the deviation from the standard change process.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is planning to replace its legacy on-premises email system with a cloud-based email service. The security team must ensure a secure migration. What is the most important security consideration during the migration?

   • AEnsure that the cloud provider has a good reputation and low prices.
   • BEnsure that data is encrypted in transit and at rest during and after migration.
   • CEnsure that user accounts and permissions are migrated correctly and that legacy accounts are disabled after migration.
   • DEnsure that the migration is completed as quickly as possible to minimize downtime.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's security policy requires that all changes to critical servers be logged and that the logs be retained for at least one year for compliance. The system administrator notices that logs are being overwritten after only 30 days. What should the administrator do to meet the policy?

   • AIncrease the log size and configure log rotation to archive logs to a secure, centralized log management system.
   • BStore logs on the local system and rely on the administrator to back them up manually each month.
   • CReduce the verbosity of logging to save space so logs last longer.
   • DDisable log rotation so that logs are never overwritten.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A manufacturing company is purchasing new industrial control system (ICS) equipment for a production line. The equipment will be connected to the corporate network for monitoring and maintenance. The security team is concerned about the security of the new equipment. What is the most important security consideration during the procurement phase?

   • ADefer security considerations until after the equipment is installed and operational.
   • BRequire the vendor to provide details on security features, patch support, and known vulnerabilities.
   • CPurchase the equipment with the most advanced features, regardless of security.
   • DEnsure the equipment is the cheapest option to reduce costs.
   Reveal Solution Discussion Select an answer first