Managing System Security GSLC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During a routine security review, an administrator discovers that a server was compromised three weeks ago. The attacker may have exfiltrated sensitive data. The server is still running and connected to the network. What is the most appropriate first step in the incident response process?

   • AImmediately shut down the server to stop further data loss.
   • BChange all user passwords and continue normal operations while monitoring the server.
   • CDisconnect the server from the network but leave it powered on to preserve volatile data for forensic analysis.
   • DRebuild the server from a known good image immediately to restore service.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has just experienced a data breach where customer credit card information was stolen. The breach was discovered by an external security researcher who notified the company. The company's incident response plan is outdated and does not cover this scenario. What is the most important immediate action?

   • ANotify all affected customers immediately before any investigation.
   • BContact the security researcher to thank them and ask for more details.
   • CActivate the incident response team and begin containment and investigation, even if the plan is outdated.
   • DUpdate the incident response plan before taking any action.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security manager is reviewing the monitoring strategy for a financial services company. The company must detect unauthorized changes to critical configuration files on its payment processing servers and retain audit logs for at least one year to meet regulatory requirements. The current solution only collects authentication logs. Which additional control is most directly needed to meet both requirements?

   • AIncrease the verbosity of authentication logs and store them on the local disk of each server.
   • BImplement a SIEM solution that only ingests network traffic data.
   • CDeploy file integrity monitoring (FIM) on the payment servers and configure the log retention policy to archive logs to cold storage for 12 months.
   • DEnable Windows Event Logging for application crashes and store logs in a central repository with a 6-month retention period.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial services firm is deploying 200 new Windows workstations for employees who handle customer data. The security team wants to ensure consistent security configurations across all devices and reduce the risk of misconfiguration. Which approach best meets this requirement?

   • ADeploy the workstations with default operating system settings and rely on the firewall to protect them.
   • BManually configure each workstation during deployment to ensure settings are tailored to individual user needs.
   • CProvide each user with a checklist of recommended security settings and ask them to apply it after first login.
   • DApply a group policy object (GPO) that enforces a hardened security baseline to all workstations in the domain.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A healthcare organization is implementing a new electronic health record (EHR) system. The system must allow nurses to view patient records and add notes, but only physicians can modify diagnoses. The organization must also ensure that access is revoked promptly when a staff member leaves. Which access control model best meets these requirements?

   • ADiscretionary access control (DAC) where each record owner decides who can view or edit their records.
   • BRole-based access control (RBAC) with role-specific permissions for nurses and physicians, integrated with the HR system for automated account deprovisioning.
   • CAttribute-based access control (ABAC) using only the user's department as the attribute.
   • DMandatory access control (MAC) using security labels on all records and user clearances.
   Reveal Solution Discussion Select an answer first