Pass Your GIAC GCCC Exam with Correct 95 Questions and Answers [Q23-Q44]

admin GCCC GIAC March 3, 2025

Rate this post

Pass Your GIAC GCCC Exam with Correct 95 Questions and Answers

Latest [Mar 03, 2025] 2025 Realistic Verified GCCC Dumps

One of the key benefits of obtaining the GIAC GCCC certification is that it demonstrates to employers and clients that the candidate has a comprehensive understanding of the critical security controls and the ability to implement them effectively. This can help to enhance the candidate’s career prospects and open up new opportunities within the field of cyber security.

GIAC Critical Controls Certification (GCCC) is a specialized certification program designed to assess an individual’s knowledge and skills in managing and implementing critical security controls in an organization. GIAC Critical Controls Certification (GCCC) certification is offered by the Global Information Assurance Certification (GIAC) program, which is a leading provider of cyber security certifications.

Q23. What tool creates visual network topology output and results that can be analyzed by Ndiff to determine if a service or network asset has changed?

Ngrep

CIS-CAT

Netscreen

Zenmap

Q24. Which of the following should be used to test antivirus software?

FIPS 140-2

Code Red

Heartbleed

EICAR

Q25. An organization has implemented a control for Controlled Use of Administrative Privileges. They are collecting audit data for each login, logout, and location for the root account of their MySQL server, but they are unable to attribute each of these logins to a specific user. What action can they take to rectify this?

Force the root account to only be accessible from the system console.

Turn on SELinux and user process accounting for the MySQL server.

Force user accounts to use ‘sudo’ f or privileged use.

Blacklist client applications from being run in privileged mode.

Q26. Which of the following is necessary to automate a control for Inventory and Control of Hardware Assets?

A method of device scanning

A centralized time server

An up-to-date hardening guide

An inventory of unauthorized assets

Q27. An analyst investigated unused organizational accounts. The investigation found that:
-10% of accounts still have their initial login password, indicating they were never used
-10% of accounts have not been used in over six months
Which change in policy would mitigate the security risk associated with both findings?

Users are required to change their password at the next login after three months

Accounts must have passwords of at least 8 characters, with one number or symbol

Accounts without login activity for 15 days are automatically locked

Q28. According to attack lifecycle models, what is the attacker’s first step in compromising an organization?

Privilege Escalation

Exploitation

Initial Compromise

Reconnaissance

Q29. Which of the following can be enabled on a Linux based system in order to make it more difficult for an attacker to execute malicious code after launching a buffer overflow attack?

ASLR

Tripwire

SUID

Iptables

TCP Wrappers

Q30. What is the first step suggested before implementing any single CIS Control?

Develop an effectiveness test

Perform a gap analysis

Perform a vulnerability scan

Develop a roll-out schedule

Q31. An auditor is focusing on potential vulnerabilities. Which of the following should cause an alert?

Workstation on which a domain admin has never logged in

Windows host with an uptime of 382 days

Server that has zero browser plug-ins

Fully patched guest machine that is not in the asset inventory

Q32. What documentation should be gathered and reviewed for evaluating an Incident Response program?

Staff member interviews

NIST Cybersecurity Framework

Policy and Procedures

Results from security training assessments

Q33. Which projects enumerates or maps security issues to CVE?

CIS Controls

SCAP

ISO 2700

NIST

Q34. An organization wants to test its procedure for data recovery. Which of the following will be most effective?

Verifying a file can be recovered from backup media

Verifying that backup process is running when it should

Verifying that network backups can’t be read in transit

Verifying there are no errors in the backup server logs

Q35. Which of the following is a reliable way to test backed up data?

Verify the file size of the backup

Confirm the backup service is running at the proper time

Compare data hashes of backed up data to original systems

Restore the data to a system

Q36. An organization is implementing a control for the Limitation and Control of Network Ports, Protocols, and Services CIS Control. Which action should they take when they discover that an application running on a web server is no longer needed?

Uninstall the application providing the service

Turn the service off in the host configuration files

Block the protocol for the unneeded service at the firewall

Create an access list on the router to filter traffic to the host

Q37. An organization has implemented a policy to continually detect and remove malware from its network. Which of the following is a detective control needed for this?

Host-based firewall sends alerts when packets are sent to a closed port

Network Intrusion Prevention sends alerts when RST packets are received

Network Intrusion Detection devices sends alerts when signatures are updated

Host-based anti-virus sends alerts to a central security console

Q38. An organization is implementing a control for the Account Monitoring and Control CIS Control, and have set the Account Lockout Policy as shown below. What is the risk presented by these settings?

Brute-force password attacks could be more effective.

Legitimate users could be unable to access resources.

Password length and complexity will be automatically reduced.

Once accounts are locked, they cannot be unlocked.

Q39. How often should the security awareness program be communicated to employees?

Continuously

Annually

Monthly

At orientation and review times

Q40. An administrator looking at a web application’s log file found login attempts by the same host over several seconds. Each user ID was attempted with three different passwords. The event took place over 5 seconds.
* ROOT
* TEST
* ADMIN
* SQL
* USER
* NAGIOSGUEST
What is the most likely source of this event?

An IT administrator attempting to use outdated credentials to enter the site

An attempted Denial of Service attack by locking out administrative accounts

An automated tool that attempts to use a dictionary attack to infiltrate a website

An attempt to use SQL Injection to gain information from a web-connected database

Q41. John a network administrator at Northeast High School. Faculty have been complaining that although they can detect and authenticate to the faculty wireless network, they are unable to connect. While troubleshooting, John discovers that the wireless network server is out of DHCP addresses due to a large number of unauthorized student devices connecting to the network. Which course of action would be an effective temporary stopgap to secure the network until a permanent solution can be found?

Limit access to allowed MAC addresses

Increase the size of the DHCP pool

Change the password immediately

Shorten the DHCP lease time

Q42. An organization has installed a firewall for Boundary Defense. It allows only outbound traffic from internal workstations for web and SSH, allows connections from the internet to the DMZ, and allows guest wireless access to the internet only. How can an auditor validate these rules?

Check for packets going from the Internet to the Web server

Try to send email from a wireless guest account

Check for packages going from the web server to the user workstations

Try to access the internal network from the wireless router

Q43. Which of the following is a benefit of stress-testing a network?

To determine device behavior in a DoS condition.

To determine bandwidth needs for the network.

To determine the connectivity of the network

To determine the security configurations of the network

Q44. An attacker is able to successfully access a web application as root using ‘ or 1 = 1 . as the password. The successful access indicates a failure of what process?

Input Validation

Output Sanitization

URL Encoding

Account Management

Loading …