GSEC Security Frameworks and CIS Controls — 10 Questions

Question 1

Refer to the exhibit. An automated audit script returns the JSON configuration status for CIS Control 10. Based on this output, what is the most immediate security implication for the listed assets?

Accepted Answer

Data at rest is susceptible to unauthorized access if physical hardware is stolen.. The output indicates a failure in CIS Control 10, which governs Malware Defenses and, in some contexts, sensitive data protection through encryption standards. The failure to enable full disk encryption on workstations and servers means that if these devices are physically stolen or accessed offline, the data at rest remains fully readable. This represents a significant risk of data breach and potential non-compliance with data protection regulations.

Answer

Unauthorized software has been installed on the listed assets.

Answer

The audit script failed to scan the network assets correctly.

Answer

The assets are missing critical OS security patches.

Question 2

Your security team is implementing CIS Control 6: Access Control Management. Which TWO of the following tasks are explicitly required to fulfill the requirements of this control?

Accepted Answer

Centralize account management using a directory service or identity provider.. CIS Control 6 focuses on managing access to enterprise assets and software. The primary objectives are to ensure that access is granted based on the principle of least privilege and that accounts are managed throughout their lifecycle. By implementing centralized account management and enforcing strict access controls, the organization limits the impact of credential theft and prevents unauthorized users from accessing sensitive enterprise resources or critical system functions.

Answer

Perform a daily scan of the network to identify rogue access points.

Answer

Ensure all workstations are running the latest antivirus signature files.

Answer

Provide security awareness training to all employees annually.

Question 3

Which of the following frameworks is primarily considered a prescriptive set of prioritized actions to protect an organization from known cyber attack vectors?

Accepted Answer

CIS Critical Security Controls. The CIS Controls are designed as a prioritized set of actions that provide a 'defense-in-depth' approach to cybersecurity. They are specifically mapped to the most common attack vectors, making them a highly practical framework for organizations. Unlike other frameworks that may be more high-level or governance-focused, the CIS Controls provide specific technical requirements that guide security teams in implementing effective, measurable security improvements across their entire enterprise infrastructure.

Answer

NIST Privacy Framework

Answer

ISO/IEC 27001

Answer

COBIT

Question 4

Which THREE of the following activities are essential components of CIS Control 7: Continuous Vulnerability Management?

Accepted Answer

Performing automated, authenticated vulnerability scans regularly.. Continuous Vulnerability Management requires a proactive and ongoing process to identify, prioritize, and remediate security weaknesses. By running regular scans, automating the patch management process, and maintaining a risk-based remediation schedule, organizations can significantly shrink the window of opportunity for attackers. This control moves away from ad-hoc patching and toward a structured, lifecycle-based approach that ensures known vulnerabilities are addressed before they can be weaponized against the enterprise infrastructure.

Answer

Updating antivirus signature files on all endpoints daily.

Answer

Maintaining an inventory of all physical hardware devices.

Question 5

A logistics company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. Which two of the following activities are required to establish and maintain secure configurations? (Choose two.)

Accepted Answer

Establishing and maintaining a secure configuration process for all enterprise assets.. CIS Control 4 requires establishing and maintaining a secure configuration process and configuring automatic updates for operating systems and software. These activities ensure that systems are hardened according to baselines and remain patched against known vulnerabilities. Other options, while beneficial, belong to different CIS Controls and do not directly fulfill the requirements of Control 4.

Answer

Conducting regular vulnerability scans on all network segments.

Answer

Implementing a whitelist of approved applications that are allowed to run.

Answer

Enforcing automatic session locking after a period of inactivity on all user devices.

Question 6

A retail company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. The IT team is reviewing the requirements to ensure they meet the control's intent. Which TWO of the following activities are explicitly required by CIS Control 4? (Choose two.)

Accepted Answer

Establish and maintain a secure configuration process for enterprise assets and software.. CIS Control 4 requires establishing and maintaining a secure configuration process (Safeguard 4.1) and configuring automatic session locking (Safeguard 4.7). These are explicit safeguards within the control. Other activities like firewall management, EDR deployment, and unique password enforcement belong to different CIS Controls. The focus of Control 4 is on hardening configurations to reduce the attack surface.

Answer

Implement and manage a firewall on all enterprise assets.

Answer

Enforce the use of unique passwords for all enterprise assets.

Answer

Deploy endpoint detection and response (EDR) agents on all enterprise assets.

Question 7

Your organization is adopting the CIS Critical Security Controls to bolster defense. You are currently focused on establishing a secure baseline configuration for all workstation images. Which specific CIS Control should you prioritize to ensure that unauthorized software and unauthorized configuration changes are mitigated?

Accepted Answer

CIS Control 4: Secure Configuration of Enterprise Assets and Software. CIS Control 4, Secure Configuration of Enterprise Assets and Software, focuses on establishing and maintaining security configurations for hardware and software. By mandating a standardized, hardened baseline for all workstations, the organization reduces the attack surface by eliminating unnecessary services and insecure settings. This is a foundational control that directly supports other security measures by ensuring that endpoints are in a known, secure state before they are deployed into the production network environment.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 2: Data Protection

Answer

CIS Control 8: Audit Log Management

Question 8

An organization is performing a gap analysis against the CIS Controls. They find that while they have strong identity management, they fail to track the software installed on local machines, leading to 'shadow IT.' Which CIS Control should they implement to address this specific visibility gap?

Accepted Answer

CIS Control 2: Inventory and Control of Software Assets. The organization's issue involves a lack of visibility into what software is running on their endpoints, which is a classic symptom of failing CIS Control 2: Inventory and Control of Software Assets. By implementing this control, organizations can maintain an authoritative list of authorized software and detect unauthorized installations, ensuring that only approved, vetted applications exist on the network, thereby reducing the risk of malware and compliance violations.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 3: Data Protection

Answer

CIS Control 7: Continuous Vulnerability Management

Question 9

An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?

Accepted Answer

Conducting a periodic, documented restore process to verify data integrity.. The testing requirement in CIS Control 11 is critical because backups are useless if they cannot be successfully restored. Organizations must not only perform regular backups but also systematically test those backups to verify data integrity and recovery speed. This ensures that in the event of a ransomware attack or accidental data loss, the organization has a reliable, validated path to restore operations quickly and minimize downtime effectively.

Answer

Running a full system backup every night at 2:00 AM.

Answer

Storing all backup tapes in an off-site, climate-controlled facility.

Answer

Encrypting all backup media to prevent unauthorized access.

Question 10

An organization is applying CIS Control 9: Email and Web Browser Protections. They have successfully implemented domain-based message authentication (DMARC). What is the primary security goal being achieved by this implementation?

Accepted Answer

Prevention of unauthorized use of the organization's domain for spoofing.. DMARC is a critical component of CIS Control 9 because it builds upon SPF and DKIM to prevent email spoofing and phishing attacks. By allowing domain owners to publish instructions on how receiving servers should handle emails that fail authentication, it significantly reduces the efficacy of fraudulent emails, thereby protecting the organization's reputation and preventing users from interacting with malicious content that leverages the organization's legitimate email domain.

Answer

Encryption of email traffic between mail servers.

Answer

Hardening web browser settings to prevent XSS attacks.

Answer

Scanning of inbound email attachments for malware signatures.