無料で使えるGCCCサンプル問題で100%カバー率のリアル試験問題（更新された95問あります) [Q22-Q38]

新問題 22
An organization has implemented a control for Controlled Use of Administrative Privileges. They are collecting audit data for each login, logout, and location for the root account of their MySQL server, but they are unable to attribute each of these logins to a specific user. What action can they take to rectify this?

新問題 23
Acme Corporation is doing a core evaluation of its centralized logging capabilities. Which of the following scenarios indicates a failure in more than one CIS Control?

新問題 24
Which of the following should be measured and analyzed regularly when implementing the Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers CIS Control?

新問題 25
An attacker is able to successfully access a web application as root using ‘ or 1 = 1 . as the password. The successful access indicates a failure of what process?

新問題 26
How often should the security awareness program be communicated to employees?

新問題 27
An organization has implemented a control for penetration testing and red team exercises conducted on their network. They have compiled metrics showing the success of the penetration testing (Penetration Tests), as well as the number of actual adversary attacks they have sustained (External Attacks). Assess the metrics below and determine the appropriate interpretation with respect to this control.

新問題 28
Which of the following is necessary to automate a control for Inventory and Control of Hardware Assets?

新問題 29
A security incident investigation identified the following modified version of a legitimate system file on a compromised client:
C:WindowsSystem32winxml.dll Addition Jan. 16, 2014 4:53:11 PM
The infection vector was determined to be a vulnerable browser plug-in installed by the user. Which of the organization’s CIS Controls failed?

新問題 30
During a security audit which test should result in a source packet failing to reach its intended destination?

新問題 31
How can the results of automated network configuration scans be used to improve the security of the network?

新問題 32
An organization has created a policy that allows software from an approved list of applications to be installed on workstations. Programs not on the list should not be installed. How can the organization best monitor compliance with the policy?

新問題 33
An organization is implementing a control within the Application Software Security CIS Control. How can they best protect against injection attacks against their custom web application and database applications?

新問題 34
Review the below results of an audit on a server. Based on these results, which document would you recommend be reviewed for training or updates?

新問題 35
What is the relationship between a service and its associated port?

新問題 36
The settings in the screenshot would be configured as part of which CIS Control?

新問題 37
Given the audit finding below, which CIS Control was being measured?

新問題 38
Which CIS Control includes storing system images on a hardened server, scanning production systems for out-of-date software, and using file integrity assessment tools like tripwire?