GSEC Security Frameworks and CIS Controls — Timed 15 Questions

Question 1

Refer to the exhibit. An automated audit script returns the JSON configuration status for CIS Control 10. Based on this output, what is the most immediate security implication for the listed assets?

Accepted Answer

Data at rest is susceptible to unauthorized access if physical hardware is stolen.. The output indicates a failure in CIS Control 10, which governs Malware Defenses and, in some contexts, sensitive data protection through encryption standards. The failure to enable full disk encryption on workstations and servers means that if these devices are physically stolen or accessed offline, the data at rest remains fully readable. This represents a significant risk of data breach and potential non-compliance with data protection regulations.

Answer

Unauthorized software has been installed on the listed assets.

Answer

The audit script failed to scan the network assets correctly.

Answer

The assets are missing critical OS security patches.

Question 2

Your security team is implementing CIS Control 6: Access Control Management. Which TWO of the following tasks are explicitly required to fulfill the requirements of this control?

Accepted Answer

Centralize account management using a directory service or identity provider.. CIS Control 6 focuses on managing access to enterprise assets and software. The primary objectives are to ensure that access is granted based on the principle of least privilege and that accounts are managed throughout their lifecycle. By implementing centralized account management and enforcing strict access controls, the organization limits the impact of credential theft and prevents unauthorized users from accessing sensitive enterprise resources or critical system functions.

Answer

Perform a daily scan of the network to identify rogue access points.

Answer

Ensure all workstations are running the latest antivirus signature files.

Answer

Provide security awareness training to all employees annually.

Question 3

Which of the following frameworks is primarily considered a prescriptive set of prioritized actions to protect an organization from known cyber attack vectors?

Accepted Answer

CIS Critical Security Controls. The CIS Controls are designed as a prioritized set of actions that provide a 'defense-in-depth' approach to cybersecurity. They are specifically mapped to the most common attack vectors, making them a highly practical framework for organizations. Unlike other frameworks that may be more high-level or governance-focused, the CIS Controls provide specific technical requirements that guide security teams in implementing effective, measurable security improvements across their entire enterprise infrastructure.

Answer

NIST Privacy Framework

Answer

ISO/IEC 27001

Answer

COBIT

Question 4

Which THREE of the following activities are essential components of CIS Control 7: Continuous Vulnerability Management?

Accepted Answer

Performing automated, authenticated vulnerability scans regularly.. Continuous Vulnerability Management requires a proactive and ongoing process to identify, prioritize, and remediate security weaknesses. By running regular scans, automating the patch management process, and maintaining a risk-based remediation schedule, organizations can significantly shrink the window of opportunity for attackers. This control moves away from ad-hoc patching and toward a structured, lifecycle-based approach that ensures known vulnerabilities are addressed before they can be weaponized against the enterprise infrastructure.

Answer

Updating antivirus signature files on all endpoints daily.

Answer

Maintaining an inventory of all physical hardware devices.

Question 5

A logistics company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. Which two of the following activities are required to establish and maintain secure configurations? (Choose two.)

Accepted Answer

Establishing and maintaining a secure configuration process for all enterprise assets.. CIS Control 4 requires establishing and maintaining a secure configuration process and configuring automatic updates for operating systems and software. These activities ensure that systems are hardened according to baselines and remain patched against known vulnerabilities. Other options, while beneficial, belong to different CIS Controls and do not directly fulfill the requirements of Control 4.

Answer

Conducting regular vulnerability scans on all network segments.

Answer

Implementing a whitelist of approved applications that are allowed to run.

Answer

Enforcing automatic session locking after a period of inactivity on all user devices.

Question 6

A retail company is implementing CIS Control 4: Secure Configuration of Enterprise Assets and Software. The IT team is reviewing the requirements to ensure they meet the control's intent. Which TWO of the following activities are explicitly required by CIS Control 4? (Choose two.)

Accepted Answer

Establish and maintain a secure configuration process for enterprise assets and software.. CIS Control 4 requires establishing and maintaining a secure configuration process (Safeguard 4.1) and configuring automatic session locking (Safeguard 4.7). These are explicit safeguards within the control. Other activities like firewall management, EDR deployment, and unique password enforcement belong to different CIS Controls. The focus of Control 4 is on hardening configurations to reduce the attack surface.

Answer

Implement and manage a firewall on all enterprise assets.

Answer

Enforce the use of unique passwords for all enterprise assets.

Answer

Deploy endpoint detection and response (EDR) agents on all enterprise assets.

Question 7

Your organization is adopting the CIS Critical Security Controls to bolster defense. You are currently focused on establishing a secure baseline configuration for all workstation images. Which specific CIS Control should you prioritize to ensure that unauthorized software and unauthorized configuration changes are mitigated?

Accepted Answer

CIS Control 4: Secure Configuration of Enterprise Assets and Software. CIS Control 4, Secure Configuration of Enterprise Assets and Software, focuses on establishing and maintaining security configurations for hardware and software. By mandating a standardized, hardened baseline for all workstations, the organization reduces the attack surface by eliminating unnecessary services and insecure settings. This is a foundational control that directly supports other security measures by ensuring that endpoints are in a known, secure state before they are deployed into the production network environment.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 2: Data Protection

Answer

CIS Control 8: Audit Log Management

Question 8

An organization is performing a gap analysis against the CIS Controls. They find that while they have strong identity management, they fail to track the software installed on local machines, leading to 'shadow IT.' Which CIS Control should they implement to address this specific visibility gap?

Accepted Answer

CIS Control 2: Inventory and Control of Software Assets. The organization's issue involves a lack of visibility into what software is running on their endpoints, which is a classic symptom of failing CIS Control 2: Inventory and Control of Software Assets. By implementing this control, organizations can maintain an authoritative list of authorized software and detect unauthorized installations, ensuring that only approved, vetted applications exist on the network, thereby reducing the risk of malware and compliance violations.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 3: Data Protection

Answer

CIS Control 7: Continuous Vulnerability Management

Question 9

An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?

Accepted Answer

Conducting a periodic, documented restore process to verify data integrity.. The testing requirement in CIS Control 11 is critical because backups are useless if they cannot be successfully restored. Organizations must not only perform regular backups but also systematically test those backups to verify data integrity and recovery speed. This ensures that in the event of a ransomware attack or accidental data loss, the organization has a reliable, validated path to restore operations quickly and minimize downtime effectively.

Answer

Running a full system backup every night at 2:00 AM.

Answer

Storing all backup tapes in an off-site, climate-controlled facility.

Answer

Encrypting all backup media to prevent unauthorized access.

Question 10

An organization is applying CIS Control 9: Email and Web Browser Protections. They have successfully implemented domain-based message authentication (DMARC). What is the primary security goal being achieved by this implementation?

Accepted Answer

Prevention of unauthorized use of the organization's domain for spoofing.. DMARC is a critical component of CIS Control 9 because it builds upon SPF and DKIM to prevent email spoofing and phishing attacks. By allowing domain owners to publish instructions on how receiving servers should handle emails that fail authentication, it significantly reduces the efficacy of fraudulent emails, thereby protecting the organization's reputation and preventing users from interacting with malicious content that leverages the organization's legitimate email domain.

Answer

Encryption of email traffic between mail servers.

Answer

Hardening web browser settings to prevent XSS attacks.

Answer

Scanning of inbound email attachments for malware signatures.

Question 11

A financial services firm is aligning its security program with the CIS Critical Security Controls. The CISO wants to ensure that the organization can measure the effectiveness of its security posture over time and prioritize improvements. Which of the following should the security team implement to achieve this?

Accepted Answer

Adopt the CIS Risk Assessment Method (CIS RAM) to identify, analyze, and prioritize risks based on the CIS Controls.. CIS RAM is specifically designed to help organizations implement the CIS Controls by providing a repeatable, risk-based assessment method. It enables the security team to measure the effectiveness of controls, identify gaps, and prioritize remediation efforts. Other options, while valuable, do not offer the same direct alignment with CIS Controls for measuring and improving security posture over time.

Answer

Conduct a penetration test to identify vulnerabilities in the organization's external-facing infrastructure.

Answer

Deploy a SIEM solution to collect and correlate security events from all network devices.

Answer

Implement the NIST Cybersecurity Framework to map current activities to the five core functions.

Question 12

A healthcare organization is implementing CIS Control 14: Security Awareness and Skills Training. The security manager needs to ensure that the training program effectively reduces phishing susceptibility among employees. Which of the following approaches best aligns with the control's requirements?

Accepted Answer

Implement a phishing simulation program with regular campaigns, provide immediate feedback to users who click, and track improvement over time.. CIS Control 14 emphasizes continuous security awareness training that includes simulated phishing exercises to test and reinforce employee skills. A program with regular phishing simulations, immediate feedback, and tracking of improvement directly measures and reduces susceptibility. Other options are either too infrequent or passive, failing to provide the practical, ongoing reinforcement that the control requires.

Answer

Require employees to complete a computer-based training module on phishing once per quarter and pass a quiz.

Answer

Send monthly security newsletters to all staff highlighting recent phishing trends and best practices.

Answer

Conduct annual security awareness training for all employees and track completion rates.

Question 13

A financial services company is aligning its security program with the CIS Critical Security Controls. The CISO asks you to identify which Implementation Group (IG) is most appropriate for a small startup with limited IT staff that handles only publicly available data and has no regulatory compliance obligations. Which IG should you recommend?

Accepted Answer

IG1. IG1 is the correct choice because it provides a foundational set of safeguards tailored to small organizations with limited resources and low-risk data. It focuses on essential cyber hygiene that addresses the most common attack vectors. For a startup with no sensitive data or regulatory requirements, IG1 offers a realistic and effective starting point without overburdening its IT staff.

Answer

IG0

Answer

IG2

Answer

IG3

Question 14

A healthcare provider is implementing CIS Control 3: Data Protection. They must ensure that data at rest is encrypted according to the safeguards. Which of the following activities directly satisfies the requirements of CIS Control 3 for data at rest?

Accepted Answer

Enabling full-disk encryption on all endpoints and servers that store protected health information.. Full-disk encryption directly satisfies the CIS Control 3 requirement to encrypt data at rest on endpoints and servers. It ensures that if a device is lost or stolen, the stored data remains unreadable. Other options address data in transit, monitoring, or physical security, which are important but do not meet the specific encryption-at-rest mandate.

Answer

Deploying a data loss prevention (DLP) solution to monitor outbound email containing patient data.

Answer

Configuring database backup files to be stored in a separate physical location with access controls.

Answer

Implementing TLS 1.2 for all web traffic to and from the electronic health record system.

Question 15

A retail company is adopting the CIS Critical Security Controls and wants to prioritize its efforts. According to the CIS Controls, which of the following is the first basic control that should be implemented to gain visibility into assets?

Accepted Answer

Inventory and Control of Enterprise Assets. Inventory and Control of Enterprise Assets is the first CIS Control because it establishes the foundation for all other controls. You cannot protect what you do not know exists. An accurate asset inventory enables effective vulnerability management, privilege control, and incident response. The CIS Controls are prioritized, with Control 1 as the starting point for any organization.

Answer

Email and Web Browser Protections

Answer

Continuous Vulnerability Management

Answer

Controlled Use of Administrative Privileges