CGRC Control Implementation — Timed 30 Questions

Question 1

When configuring Cisco ASA firewall rules, you notice that traffic is being dropped despite an 'allow' access-list. What is the most likely cause?

Accepted Answer

The rule is placed after a 'deny ip any any' rule in the same list. Cisco ASA processes access-list entries sequentially from top to bottom and stops at the first match. If a 'deny ip any any' entry appears before the intended 'permit' entry in the same ACL, all matching traffic is dropped before the permit is ever evaluated. The fix is to reorder the ACEs so the permit precedes the deny, or remove the overly broad deny.

Answer

The interface is not assigned to a security zone

Answer

The traffic is encrypted by VPN

Answer

Missing 'permit ip any any' at the top

Question 2

You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?

Accepted Answer

Apply filters on the Universal Forwarder. Applying filters on the Universal Forwarder reduces noise by preventing unnecessary events from being sent to the SIEM indexer, while still allowing relevant failed login events to be captured. This maintains audit integrity because the filtering is done at the source, and the original logs remain on the source system if needed for forensic analysis.

Answer

Disable logging on the domain controller

Answer

Delete logs after ingestion

Answer

Increase log rotation frequency

Question 3

When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?

Accepted Answer

SPF. SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers authorized to send email on behalf of a domain. Receiving mail servers check the envelope sender's domain against the SPF record and reject or flag messages from unauthorized senders, directly mitigating domain spoofing. It is the correct DNS-based anti-spoofing control for an email security gateway to enforce.

Answer

CNAME

Answer

A

Answer

MX

Question 4

You are managing access to a file server. You want to ensure that users can read files but not delete them. What is this an example of?

Accepted Answer

Read-Only permission. Read-Only permission grants users the ability to view and open files but not to modify, delete, or create them, which exactly matches the requirement of reading without deleting. In Windows NTFS, the Read & Execute/Read permissions and the 'Read' basic permission enforce this; in POSIX, read (r) without write (w) on the file or directory achieves the same effect.

Answer

Modify permission

Answer

Full Control

Answer

Write permission

Question 5

A multinational corporation is deploying a new cloud-based customer relationship management (CRM) system. The security team must ensure that data stored in the CRM is protected in accordance with the organization's data classification policy. Which two of the following controls are most appropriate to implement for data at rest in the CRM? (Choose two.)

Accepted Answer

AES-256 encryption for database fields containing sensitive data. Field-level encryption with AES-256 and role-based access control directly protect data at rest by making it unreadable without keys and restricting who can access it. TLS protects data in transit, FDE addresses physical disk theft but not application-level access, and network segmentation is a perimeter control. Together, encryption and RBAC provide defense in depth for stored data.

Answer

Full disk encryption (FDE) on the database server

Answer

Network segmentation to isolate the CRM database

Answer

TLS 1.3 for data in transit between the web server and database

Question 6

A retail company is deploying a new point-of-sale (POS) system that must comply with PCI DSS. The security team is reviewing logical access controls for the POS environment. Which TWO of the following are appropriate logical access controls to implement? (Choose two.)

Accepted Answer

Multi-factor authentication for administrative access to POS servers. Logical access controls manage how users and systems authenticate and authorize access to resources. Multi-factor authentication and unique user IDs with strong passwords are both logical controls that directly restrict and monitor access to the POS environment. Physical locks, cameras, and network segmentation address different security domains and do not satisfy the requirement for logical access controls.

Answer

Network segmentation between the POS system and corporate network

Answer

Security cameras monitoring the POS area

Answer

Physical locks on POS terminals

Question 7

A financial services firm is implementing controls to comply with the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. The security team is evaluating technical controls for protecting customer nonpublic personal information (NPI). Which two of the following are appropriate technical controls to mitigate the risk of unauthorized access to NPI? (Choose two.)

Accepted Answer

Enforcing encryption of NPI at rest using AES-256.. Encryption at rest and database activity monitoring are technical controls that directly protect NPI from unauthorized access. Encryption prevents data disclosure if storage is compromised, while DAM detects and alerts on suspicious access. The other options are administrative or detective controls that do not technically enforce protection, so they do not meet the criteria for technical controls in this scenario.

Answer

Conducting annual security awareness training for all employees.

Answer

Performing quarterly vulnerability scans of the network.

Answer

Implementing mandatory vacation policies for employees with access to NPI.

Question 8

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. To ensure that only signed binaries from your organization are executed, you should create a Publisher Rule based on the certificate issuer and product name. Publisher Rules in AppLocker use digital signatures to identify trusted publishers, allowing execution of any binary signed by a specific certificate. This approach is scalable and ensures that only binaries signed by your organization's certificate are allowed, while automatically accommodating updates signed with the same certificate.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 9

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

Accepted Answer

dm-crypt/LUKS. dm-crypt is the Linux kernel's transparent disk-encryption subsystem, and LUKS (Linux Unified Key Setup) is the standard on-disk format that manages keys, headers, and passphrases. Together they provide full-disk encryption on Linux servers, satisfying PCI-DSS Requirement 3.4/3.5 for rendering stored cardholder data unreadable. Tools like cryptsetup wrap dm-crypt/LUKS, and it works across most distributions without third-party licensing.

Answer

BitLocker

Answer

IPsec

Answer

VeraCrypt

Question 10

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. An AWS Security Group is stateful and evaluates inbound traffic against inbound rules; to permit public HTTPS access to the web server, you must create an inbound rule allowing TCP 443 from 0.0.0.0/0 (the entire IPv4 internet). The source 0.0.0.0/0 is the correct CIDR notation for 'any IPv4 address,' and specifying HTTPS/443 matches the standard secure web port. This rule satisfies the requirement to allow incoming HTTPS while other traffic remains blocked by default due to Security Groups' implicit deny.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 11

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

Accepted Answer

On a Span Port of the core distribution switch. A SPAN (Switched Port Analyzer) port on the core distribution switch mirrors traffic from multiple VLANs and internal segments, allowing the IDS/IPS sensor to see both internal east-west traffic and external north-south traffic traversing the core. Placing the sensor at the core distribution layer provides the broadest visibility without disrupting production traffic, since SPAN ports are passive copies. This is the standard architectural recommendation for monitoring both internal and external communications in a switched environment.

Answer

Directly on the public ISP router

Answer

Inside the isolated guest Wi-Fi network

Answer

On the WAN interface of the firewall

Question 12

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

Accepted Answer

Certificate Revocation List (CRL) Distribution Point. To enable revocation, a Certificate Revocation List (CRL) Distribution Point must be configured in the certificate templates and CA settings. This CDP URL is embedded in issued certificates, allowing clients to download the CRL and check revocation status. Without a CDP, clients cannot locate the CRL, and revocation checks fail.

Answer

OCSP Responder

Answer

Key Archival

Answer

Trust Anchor

Question 13

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

Accepted Answer

Azure AD Conditional Access Policy. Microsoft Entra Conditional Access Policy is the most recommended modern authentication control because it allows granular, signal-based enforcement of MFA — evaluating user, device, location, application, and risk signals before granting access. Unlike Security Defaults, which apply a blunt tenant-wide MFA requirement, Conditional Access supports targeted policies (e.g., require MFA for admins or external access) and integrates with Identity Protection risk signals. This makes it the Microsoft-recommended path for organizations that need flexible, zero-trust-aligned MFA enforcement.

Answer

Password Protection Policy

Answer

Security Defaults

Answer

Identity Protection User Risk Policy

Question 14

When implementing an 802.1X environment, what is the role of the RADIUS server?

Accepted Answer

Authenticating the supplicant. In an 802.1X deployment, the RADIUS server acts as the authentication server (AS) that receives EAP messages relayed by the authenticator (switch or WAP) and validates the supplicant's credentials against a backend identity store such as Active Directory or LDAP. It is the decision point that returns Access-Accept, Access-Reject, or Access-Challenge per RFC 2865/2866, and can also pass authorization attributes like VLAN or ACL assignments. The supplicant is the endpoint requesting access, and the authenticator is the network device enforcing the port state — the RADIUS server's core job is authenticating the supplicant.

Answer

Encapsulating EAP frames

Answer

Providing the EAP method to the client

Answer

Enforcing the physical port state

Question 15

In VMware vSphere, what is the best practice for securing virtual machine consoles?

Accepted Answer

Use the VMRC (VMware Remote Console) with encrypted connections. The VMware Remote Console (VMRC) is the supported, secure method for accessing VM consoles in vSphere. It establishes an encrypted TLS connection to the ESXi host or vCenter, ensuring that console traffic—including keystrokes and screen data—cannot be intercepted. Using VMRC also integrates with vSphere permissions, so access is auditable and role-based, unlike raw VNC or shared credentials.

Answer

Share the ESXi root password

Answer

Disable all logging

Answer

Leave the VNC port open

Question 16

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

Accepted Answer

Implement Separation of Duties. Separation of Duties (SoD) is an administrative control that divides critical functions among different individuals so that no single person has enough privileges to compromise the system. For a DBA account, SoD ensures that the ability to modify data, change schemas, and manage backups or audit logs is split across multiple roles, so a compromised DBA account cannot unilaterally cause widespread damage or cover tracks. This minimizes impact by limiting the blast radius of a single compromised account.

Answer

Disable all auditing

Answer

Store passwords in plain text

Answer

Use a single shared account

Question 17

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the primary, account- and bucket-level control specifically designed to override any policy or ACL that would grant public access, acting as a centralized guardrail. It can be applied at the account level to prevent any bucket from becoming public, which is the strongest preventive mechanism. This directly addresses the requirement to prevent public exposure of PII stored in S3.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 18

What is the physical security control used to prevent piggybacking at an entry point?

Accepted Answer

Mantrap. A mantrap is a physical access control consisting of two interlocking doors with a small vestibule between them, designed so that only one door can open at a time. This forces each person to authenticate individually before proceeding, which physically prevents tailgating/piggybacking because an unauthorized follower cannot slip through behind an authenticated user. It is the only option that directly and physically stops the act of piggybacking at the entry point.

Answer

Biometric scanner

Answer

CCTV camera

Answer

Security guard

Question 19

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A jump server (bastion host) with multi-factor authentication (MFA) enforces a controlled, auditable entry point to the production network, requiring a second authentication factor before any access is granted. This architecture centralizes access logging, session recording, and credential management, and it prevents direct exposure of production servers to the internet. By combining a hardened intermediary with MFA, the organization achieves defense in depth and satisfies least-privilege and non-repudiation requirements.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 20

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

Accepted Answer

INPUT. In iptables, the INPUT chain processes packets destined for the local host itself, making it the correct place to filter traffic addressed to the machine. The OUTPUT chain handles locally generated outbound traffic, and FORWARD handles packets routed through the host. Therefore, filtering traffic destined for the local host requires the INPUT chain.

Answer

OUTPUT

Answer

FORWARD

Answer

PREROUTING