GSEC Security Frameworks and CIS Controls — All Questions With Answers

Question 1

Refer to the exhibit. An automated audit script returns the JSON configuration status for CIS Control 10. Based on this output, what is the most immediate security implication for the listed assets?

Accepted Answer

Data at rest is susceptible to unauthorized access if physical hardware is stolen.. The output indicates a failure in CIS Control 10, which governs Malware Defenses and, in some contexts, sensitive data protection through encryption standards. The failure to enable full disk encryption on workstations and servers means that if these devices are physically stolen or accessed offline, the data at rest remains fully readable. This represents a significant risk of data breach and potential non-compliance with data protection regulations.

Answer

Unauthorized software has been installed on the listed assets.

Answer

The audit script failed to scan the network assets correctly.

Answer

The assets are missing critical OS security patches.

Question 2

Your security team is implementing CIS Control 6: Access Control Management. Which TWO of the following tasks are explicitly required to fulfill the requirements of this control?

Accepted Answer

Centralize account management using a directory service or identity provider.. CIS Control 6 focuses on managing access to enterprise assets and software. The primary objectives are to ensure that access is granted based on the principle of least privilege and that accounts are managed throughout their lifecycle. By implementing centralized account management and enforcing strict access controls, the organization limits the impact of credential theft and prevents unauthorized users from accessing sensitive enterprise resources or critical system functions.

Answer

Perform a daily scan of the network to identify rogue access points.

Answer

Ensure all workstations are running the latest antivirus signature files.

Answer

Provide security awareness training to all employees annually.

Question 3

Which of the following frameworks is primarily considered a prescriptive set of prioritized actions to protect an organization from known cyber attack vectors?

Accepted Answer

CIS Critical Security Controls. The CIS Controls are designed as a prioritized set of actions that provide a 'defense-in-depth' approach to cybersecurity. They are specifically mapped to the most common attack vectors, making them a highly practical framework for organizations. Unlike other frameworks that may be more high-level or governance-focused, the CIS Controls provide specific technical requirements that guide security teams in implementing effective, measurable security improvements across their entire enterprise infrastructure.

Answer

NIST Privacy Framework

Answer

ISO/IEC 27001

Answer

COBIT

Question 4

Which THREE of the following activities are essential components of CIS Control 7: Continuous Vulnerability Management?

Accepted Answer

Performing automated, authenticated vulnerability scans regularly.. Continuous Vulnerability Management requires a proactive and ongoing process to identify, prioritize, and remediate security weaknesses. By running regular scans, automating the patch management process, and maintaining a risk-based remediation schedule, organizations can significantly shrink the window of opportunity for attackers. This control moves away from ad-hoc patching and toward a structured, lifecycle-based approach that ensures known vulnerabilities are addressed before they can be weaponized against the enterprise infrastructure.

Answer

Updating antivirus signature files on all endpoints daily.

Answer

Maintaining an inventory of all physical hardware devices.

Question 5

A logistics company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. Which two of the following activities are required to establish and maintain secure configurations? (Choose two.)

Accepted Answer

Establishing and maintaining a secure configuration process for all enterprise assets.. CIS Control 4 requires establishing and maintaining a secure configuration process and configuring automatic updates for operating systems and software. These activities ensure that systems are hardened according to baselines and remain patched against known vulnerabilities. Other options, while beneficial, belong to different CIS Controls and do not directly fulfill the requirements of Control 4.

Answer

Conducting regular vulnerability scans on all network segments.

Answer

Implementing a whitelist of approved applications that are allowed to run.

Answer

Enforcing automatic session locking after a period of inactivity on all user devices.

Question 6

A retail company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. The IT team is reviewing the requirements to ensure they meet the control's intent. Which TWO of the following activities are explicitly required by CIS Control 4? (Choose two.)

Accepted Answer

Establish and maintain a secure configuration process for enterprise assets and software.. CIS Control 4 requires establishing and maintaining a secure configuration process (Safeguard 4.1) and configuring automatic session locking (Safeguard 4.7). These are explicit safeguards within the control. Other activities like firewall management, EDR deployment, and unique password enforcement belong to different CIS Controls. The focus of Control 4 is on hardening configurations to reduce the attack surface.

Answer

Implement and manage a firewall on all enterprise assets.

Answer

Enforce the use of unique passwords for all enterprise assets.

Answer

Deploy endpoint detection and response (EDR) agents on all enterprise assets.

Question 7

Your organization is adopting the CIS Critical Security Controls to bolster defense. You are currently focused on establishing a secure baseline configuration for all workstation images. Which specific CIS Control should you prioritize to ensure that unauthorized software and unauthorized configuration changes are mitigated?

Accepted Answer

CIS Control 4: Secure Configuration of Enterprise Assets and Software. CIS Control 4, Secure Configuration of Enterprise Assets and Software, focuses on establishing and maintaining security configurations for hardware and software. By mandating a standardized, hardened baseline for all workstations, the organization reduces the attack surface by eliminating unnecessary services and insecure settings. This is a foundational control that directly supports other security measures by ensuring that endpoints are in a known, secure state before they are deployed into the production network environment.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 2: Data Protection

Answer

CIS Control 8: Audit Log Management

Question 8

An organization is performing a gap analysis against the CIS Controls. They find that while they have strong identity management, they fail to track the software installed on local machines, leading to 'shadow IT.' Which CIS Control should they implement to address this specific visibility gap?

Accepted Answer

CIS Control 2: Inventory and Control of Software Assets. The organization's issue involves a lack of visibility into what software is running on their endpoints, which is a classic symptom of failing CIS Control 2: Inventory and Control of Software Assets. By implementing this control, organizations can maintain an authoritative list of authorized software and detect unauthorized installations, ensuring that only approved, vetted applications exist on the network, thereby reducing the risk of malware and compliance violations.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 3: Data Protection

Answer

CIS Control 7: Continuous Vulnerability Management

Question 9

An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?

Accepted Answer

Conducting a periodic, documented restore process to verify data integrity.. The testing requirement in CIS Control 11 is critical because backups are useless if they cannot be successfully restored. Organizations must not only perform regular backups but also systematically test those backups to verify data integrity and recovery speed. This ensures that in the event of a ransomware attack or accidental data loss, the organization has a reliable, validated path to restore operations quickly and minimize downtime effectively.

Answer

Running a full system backup every night at 2:00 AM.

Answer

Storing all backup tapes in an off-site, climate-controlled facility.

Answer

Encrypting all backup media to prevent unauthorized access.

Question 10

An organization is applying CIS Control 9: Email and Web Browser Protections. They have successfully implemented domain-based message authentication (DMARC). What is the primary security goal being achieved by this implementation?

Accepted Answer

Prevention of unauthorized use of the organization's domain for spoofing.. DMARC is a critical component of CIS Control 9 because it builds upon SPF and DKIM to prevent email spoofing and phishing attacks. By allowing domain owners to publish instructions on how receiving servers should handle emails that fail authentication, it significantly reduces the efficacy of fraudulent emails, thereby protecting the organization's reputation and preventing users from interacting with malicious content that leverages the organization's legitimate email domain.

Answer

Encryption of email traffic between mail servers.

Answer

Hardening web browser settings to prevent XSS attacks.

Answer

Scanning of inbound email attachments for malware signatures.

Question 11

A financial services firm is aligning its security program with the CIS Critical Security Controls. The CISO wants to ensure that the organization can measure the effectiveness of its security posture over time and prioritize improvements. Which of the following should the security team implement to achieve this?

Accepted Answer

Adopt the CIS Risk Assessment Method (CIS RAM) to identify, analyze, and prioritize risks based on the CIS Controls.. CIS RAM is specifically designed to help organizations implement the CIS Controls by providing a repeatable, risk-based assessment method. It enables the security team to measure the effectiveness of controls, identify gaps, and prioritize remediation efforts. Other options, while valuable, do not offer the same direct alignment with CIS Controls for measuring and improving security posture over time.

Answer

Conduct a penetration test to identify vulnerabilities in the organization's external-facing infrastructure.

Answer

Deploy a SIEM solution to collect and correlate security events from all network devices.

Answer

Implement the NIST Cybersecurity Framework to map current activities to the five core functions.

Question 12

A healthcare organization is implementing CIS Control 14: Security Awareness and Skills Training. The security manager needs to ensure that the training program effectively reduces phishing susceptibility among employees. Which of the following approaches best aligns with the control's requirements?

Accepted Answer

Implement a phishing simulation program with regular campaigns, provide immediate feedback to users who click, and track improvement over time.. CIS Control 14 emphasizes continuous security awareness training that includes simulated phishing exercises to test and reinforce employee skills. A program with regular phishing simulations, immediate feedback, and tracking of improvement directly measures and reduces susceptibility. Other options are either too infrequent or passive, failing to provide the practical, ongoing reinforcement that the control requires.

Answer

Require employees to complete a computer-based training module on phishing once per quarter and pass a quiz.

Answer

Send monthly security newsletters to all staff highlighting recent phishing trends and best practices.

Answer

Conduct annual security awareness training for all employees and track completion rates.

Question 13

A financial services company is aligning its security program with the CIS Critical Security Controls. The CISO asks you to identify which Implementation Group (IG) is most appropriate for a small startup with limited IT staff that handles only publicly available data and has no regulatory compliance obligations. Which IG should you recommend?

Accepted Answer

IG1. IG1 is the correct choice because it provides a foundational set of safeguards tailored to small organizations with limited resources and low-risk data. It focuses on essential cyber hygiene that addresses the most common attack vectors. For a startup with no sensitive data or regulatory requirements, IG1 offers a realistic and effective starting point without overburdening its IT staff.

Answer

IG0

Answer

IG2

Answer

IG3

Question 14

A healthcare provider is implementing CIS Control 3: Data Protection. They must ensure that data at rest is encrypted according to the safeguards. Which of the following activities directly satisfies the requirements of CIS Control 3 for data at rest?

Accepted Answer

Enabling full-disk encryption on all endpoints and servers that store protected health information.. Full-disk encryption directly satisfies the CIS Control 3 requirement to encrypt data at rest on endpoints and servers. It ensures that if a device is lost or stolen, the stored data remains unreadable. Other options address data in transit, monitoring, or physical security, which are important but do not meet the specific encryption-at-rest mandate.

Answer

Deploying a data loss prevention (DLP) solution to monitor outbound email containing patient data.

Answer

Configuring database backup files to be stored in a separate physical location with access controls.

Answer

Implementing TLS 1.2 for all web traffic to and from the electronic health record system.

Question 15

A retail company is adopting the CIS Critical Security Controls and wants to prioritize its efforts. According to the CIS Controls, which of the following is the first basic control that should be implemented to gain visibility into assets?

Accepted Answer

Inventory and Control of Enterprise Assets. Inventory and Control of Enterprise Assets is the first CIS Control because it establishes the foundation for all other controls. You cannot protect what you do not know exists. An accurate asset inventory enables effective vulnerability management, privilege control, and incident response. The CIS Controls are prioritized, with Control 1 as the starting point for any organization.

Answer

Email and Web Browser Protections

Answer

Continuous Vulnerability Management

Answer

Controlled Use of Administrative Privileges

Question 16

A financial services firm has implemented all 18 CIS Critical Security Controls at Implementation Group 2. During a board presentation, the CISO is asked how the organization should measure the effectiveness of its security program. Which of the following best describes the role of Implementation Groups within the CIS Controls framework?

Accepted Answer

Implementation Groups are prioritized sets of safeguards tailored to an organization's risk profile and resources, with IG1 being foundational, IG2 for organizations with moderate risk, and IG3 for high-risk environments.. Implementation Groups provide a risk-based approach to adopting the CIS Controls. They help organizations prioritize safeguards according to their specific risk profile and resources, rather than a one-size-fits-all model. IG1 is foundational for all, IG2 adds for moderate risk, and IG3 for high-risk. This allows the firm to measure effectiveness by assessing implementation of the relevant safeguards within its chosen IG.

Answer

Implementation Groups are used exclusively by small businesses, while large enterprises must implement all 18 controls regardless of risk.

Answer

Implementation Groups are optional certifications that an organization can obtain to demonstrate compliance with the CIS Controls.

Answer

Implementation Groups are maturity levels that an organization must sequentially achieve, with IG1 being the lowest and IG3 the highest.

Question 17

A university is implementing CIS Control 6: Access Control Management. They want to ensure that user accounts are properly managed. Which of the following actions best aligns with the requirement to manage the lifecycle of user accounts?

Accepted Answer

Conducting quarterly reviews of all user accounts to identify and disable inactive accounts.. Quarterly reviews of user accounts directly support the lifecycle management requirement of CIS Control 6. By identifying and disabling inactive accounts, the university reduces the risk of unauthorized access through stale credentials. Other actions like password policies, MFA, and PAM are valuable but do not fulfill the specific need to manage account lifecycles across all users.

Answer

Implementing multi-factor authentication for all administrative access to servers.

Answer

Deploying a privileged access management (PAM) solution to vault administrative credentials.

Answer

Enforcing a password complexity policy that requires 12 characters with mixed case and symbols.

Question 18

A healthcare provider is aligning its security program with the CIS Critical Security Controls. The security team is tasked with implementing CIS Control 1: Inventory and Control of Enterprise Assets. Which of the following activities is the most critical first step to ensure the control is effectively implemented?

Accepted Answer

Creating a formal policy that defines what constitutes an enterprise asset and assigns ownership for maintaining the inventory.. CIS Control 1 emphasizes the importance of a formalized process for inventory and control of enterprise assets. The initial step is to create a policy that defines the scope and assigns ownership. This ensures that the inventory is accurate, maintained, and aligned with organizational needs. Without this governance, technical implementations may lack direction and accountability, leading to an ineffective control.

Answer

Deploying an automated asset discovery tool to scan the network for all connected devices.

Answer

Implementing a configuration management database (CMDB) to store asset information.

Answer

Conducting a manual inventory of all assets in the data center.

Question 19

A small marketing agency has limited IT staff and resources. They are looking to adopt a security framework to protect their assets. They have heard about the CIS Critical Security Controls and want to know which Implementation Group is most appropriate for their situation. Which of the following should they choose?

Accepted Answer

Implementation Group 1 (IG1) because it provides foundational cyber hygiene suitable for organizations with limited resources.. Implementation Group 1 (IG1) is specifically designed for small organizations with limited resources. It offers a foundational set of 56 safeguards that address the most common cyber threats. For a small marketing agency, IG1 provides a manageable and effective starting point to improve security posture without requiring extensive resources or expertise.

Answer

Implementation Group 3 (IG3) because it offers the highest level of security.

Answer

Implementation Group 2 (IG2) because it includes additional safeguards for moderate risk organizations.

Answer

None of the Implementation Groups; they should develop a custom framework from scratch.

Question 20

A multinational corporation is aligning its incident response program with the CIS Critical Security Controls. They are focusing on CIS Control 17: Incident Response Management. Which of the following activities best demonstrates the establishment of a formal incident response process as required by this control?

Accepted Answer

Establishing and maintaining a documented incident response plan that defines roles, responsibilities, and communication procedures.. CIS Control 17 requires establishing and maintaining a documented incident response plan that defines roles, responsibilities, and communication procedures. This formal documentation is the foundation of the incident response process. While tools, exercises, and designated personnel are valuable, they are not sufficient without a documented plan that guides the overall response effort.

Answer

Designating a single individual as the incident response coordinator without a formal team.

Answer

Conducting an annual tabletop exercise without updating the incident response plan based on findings.

Answer

Purchasing an incident response automation tool to streamline handling of security incidents.

GSEC Security Frameworks and CIS Controls — All Questions With Answers

Refer to the exhibit. An automated audit script returns the JSON configuration status for CIS Control 10. Based on this output, what is the most immediate security implication for the listed assets?

Exhibit

Your security team is implementing CIS Control 6: Access Control Management. Which TWO of the following tasks are explicitly required to fulfill the requirements of this control?

Which of the following frameworks is primarily considered a prescriptive set of prioritized actions to protect an organization from known cyber attack vectors?

Which THREE of the following activities are essential components of CIS Control 7: Continuous Vulnerability Management?

A logistics company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. Which two of the following activities are required to establish and maintain secure configurations? (Choose two.)

A retail company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. The IT team is reviewing the requirements to ensure they meet the control's intent. Which TWO of the following activities are explicitly required by CIS Control 4? (Choose two.)

An organization is performing a gap analysis against the CIS Controls. They find that while they have strong identity management, they fail to track the software installed on local machines, leading to 'shadow IT.' Which CIS Control should they implement to address this specific visibility gap?

An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?

An organization is applying CIS Control 9: Email and Web Browser Protections. They have successfully implemented domain-based message authentication (DMARC). What is the primary security goal being achieved by this implementation?

A healthcare organization is implementing CIS Control 14: Security Awareness and Skills Training. The security manager needs to ensure that the training program effectively reduces phishing susceptibility among employees. Which of the following approaches best aligns with the control's requirements?

A healthcare provider is implementing CIS Control 3: Data Protection. They must ensure that data at rest is encrypted according to the safeguards. Which of the following activities directly satisfies the requirements of CIS Control 3 for data at rest?

A retail company is adopting the CIS Critical Security Controls and wants to prioritize its efforts. According to the CIS Controls, which of the following is the first basic control that should be implemented to gain visibility into assets?

A university is implementing CIS Control 6: Access Control Management. They want to ensure that user accounts are properly managed. Which of the following actions best aligns with the requirement to manage the lifecycle of user accounts?

GSEC Security Frameworks and CIS Controls — All Questions With Answers

Refer to the exhibit. An automated audit script returns the JSON configuration status for CIS Control 10. Based on this output, what is the most immediate security implication for the listed assets?

Exhibit

Your security team is implementing CIS Control 6: Access Control Management. Which TWO of the following tasks are explicitly required to fulfill the requirements of this control?

Which of the following frameworks is primarily considered a prescriptive set of prioritized actions to protect an organization from known cyber attack vectors?

Which THREE of the following activities are essential components of CIS Control 7: Continuous Vulnerability Management?

A logistics company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. Which two of the following activities are required to establish and maintain secure configurations? (Choose two.)

A retail company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. The IT team is reviewing the requirements to ensure they meet the control's intent. Which TWO of the following activities are explicitly required by CIS Control 4? (Choose two.)

An organization is performing a gap analysis against the CIS Controls. They find that while they have strong identity management, they fail to track the software installed on local machines, leading to 'shadow IT.' Which CIS Control should they implement to address this specific visibility gap?

An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?

An organization is applying CIS Control 9: Email and Web Browser Protections. They have successfully implemented domain-based message authentication (DMARC). What is the primary security goal being achieved by this implementation?

A healthcare organization is implementing CIS Control 14: Security Awareness and Skills Training. The security manager needs to ensure that the training program effectively reduces phishing susceptibility among employees. Which of the following approaches best aligns with the control's requirements?

A healthcare provider is implementing CIS Control 3: Data Protection. They must ensure that data at rest is encrypted according to the safeguards. Which of the following activities directly satisfies the requirements of CIS Control 3 for data at rest?

A retail company is adopting the CIS Critical Security Controls and wants to prioritize its efforts. According to the CIS Controls, which of the following is the first basic control that should be implemented to gain visibility into assets?

A university is implementing CIS Control 6: Access Control Management. They want to ensure that user accounts are properly managed. Which of the following actions best aligns with the requirement to manage the lifecycle of user accounts?