CGRC Control Implementation — 20 Questions

Question 1

When configuring Cisco ASA firewall rules, you notice that traffic is being dropped despite an 'allow' access-list. What is the most likely cause?

Accepted Answer

The rule is placed after a 'deny ip any any' rule in the same list. The Cisco ASA uses an 'implicit deny' at the end of every access-list, and the order of rules matters.

Answer

The interface is not assigned to a security zone

Answer

The traffic is encrypted by VPN

Answer

Missing 'permit ip any any' at the top

Question 2

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. Publisher rules in AppLocker allow for the most granular control based on digital certificates.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 3

You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?

Accepted Answer

Apply filters on the Universal Forwarder. Filtering at the forwarder level prevents unnecessary ingestion of logs, saving storage and improving performance.

Answer

Disable logging on the domain controller

Answer

Delete logs after ingestion

Answer

Increase log rotation frequency

Question 4

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

Accepted Answer

dm-crypt/LUKS. dm-crypt/LUKS is the industry-standard tool for transparent full disk encryption on Linux.

Answer

BitLocker

Answer

IPsec

Answer

VeraCrypt

Question 5

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. Security groups are stateful; allowing inbound traffic automatically allows the return traffic, and the default is to deny all other traffic.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 6

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

Accepted Answer

On a Span Port of the core distribution switch. Placing the sensor on the span port of the core switch allows visibility into internal traffic flows.

Answer

Directly on the public ISP router

Answer

Inside the isolated guest Wi-Fi network

Answer

On the WAN interface of the firewall

Question 7

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

Accepted Answer

Certificate Revocation List (CRL) Distribution Point. A Certificate Revocation List (CRL) is essential for clients to verify if a certificate is still valid.

Answer

OCSP Responder

Answer

Key Archival

Answer

Trust Anchor

Question 8

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

Accepted Answer

Azure AD Conditional Access Policy. Conditional Access policies allow for risk-based and context-aware authentication enforcement.

Answer

Password Protection Policy

Answer

Security Defaults

Answer

Identity Protection User Risk Policy

Question 9

When implementing an 802.1X environment, what is the role of the RADIUS server?

Accepted Answer

Authenticating the supplicant. The RADIUS server acts as the Authentication Server, validating the credentials provided by the supplicant via the authenticator.

Answer

Encapsulating EAP frames

Answer

Providing the EAP method to the client

Answer

Enforcing the physical port state

Question 10

In VMware vSphere, what is the best practice for securing virtual machine consoles?

Accepted Answer

Use the VMRC (VMware Remote Console) with encrypted connections. Disabling the remote console access or enforcing authentication is vital to prevent unauthorized access.

Answer

Share the ESXi root password

Answer

Disable all logging

Answer

Leave the VNC port open

Question 11

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

Accepted Answer

Implement Separation of Duties. Separation of duties ensures no single administrator has total control over all aspects, minimizing risk.

Answer

Disable all auditing

Answer

Store passwords in plain text

Answer

Use a single shared account

Question 12

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access settings provide a centralized, account-wide or bucket-level override to prevent accidental exposure.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 13

What is the physical security control used to prevent piggybacking at an entry point?

Accepted Answer

Mantrap. A mantrap is a physical system that requires one door to be closed before the other opens, preventing unauthorized entry.

Answer

Biometric scanner

Answer

CCTV camera

Answer

Security guard

Question 14

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A Bastion Host with MFA ensures that access to production is controlled, logged, and authenticated securely.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 15

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

Accepted Answer

INPUT. The INPUT chain handles traffic that is addressed to the host machine itself.

Answer

OUTPUT

Answer

FORWARD

Answer

PREROUTING

Question 16

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

Accepted Answer

To identify missing patches and misconfigurations. Credentialed scans allow the tool to look inside the OS and application configuration, providing more accurate results.

Answer

To perform penetration testing

Answer

To automate the patching process

Answer

To bypass the firewall

Question 17

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Accepted Answer

Exclude known safe processes and signers. Tuning policies to exclude known safe administrative scripts and software reduces noise while maintaining core monitoring.

Answer

Only monitor server logs

Answer

Set to 'Block All' mode

Answer

Disable real-time scanning

Question 18

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. A formal change control process is required to ensure that changes are tested, documented, and approved.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 19

Which type of control is an alarm system installed in a server room?

Accepted Answer

Detective. An alarm system is a detective control designed to alert staff of unauthorized presence.

Answer

Preventative

Answer

Corrective

Answer

Deterrent

Question 20

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

Accepted Answer

The server's TLS configuration file. The web server's SSL/TLS configuration file (e.g., httpd.conf or nginx.conf) defines the supported cipher suites.

Answer

The server's BIOS settings

Answer

The web application's root directory

Answer

The firewall access control list