GCCC Practice Questions

The European Institute for Computer Antivirus Research (EICAR) test file is the industry standard for testing the functionality of antivirus software. It is a harmless, non-viral text file containing a specific string of 68 characters. This file is designed to be detected by antivirus programs as if it were a real virus. This allows administrators and users to safely verify that their antivirus scanner is configured and working correctly without using actual, malicious code, which would pose a significant security risk.

A. FIPS 140-2 is a U.S. government standard that specifies security requirements for cryptographic modules, not a tool for testing antivirus software.

B. Code Red was a specific, real computer worm from 2001. Using actual malware for testing is highly dangerous and not a standard procedure.

C. Heartbleed was a critical security vulnerability in the OpenSSL cryptographic library, not a virus or a file used to test antivirus detection capabilities.

1. National Institute of Standards and Technology (NIST), Special Publication 800-83 Revision 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, July 2013. Section 3.3.1, "Configure and Maintain Anti-Malware Software," states, "Organizations should also verify that the software is working correctly... This can be done safely by using a test file, such as the European Institute for Computer Antivirus Research (EICAR) test file."

2. EICAR (European Institute for Computer Antivirus Research), "The EICAR Test File." The official website explains, "The EICAR test file is a legitimate DOS program, and completely harmless... It was developed by the European Institute for Computer Antivirus Research (EICAR) to test the response of computer antivirus programs."

3. Microsoft Corporation, Microsoft Defender for Endpoint documentation, "Run a detection test on a newly onboarded Microsoft Defender for Endpoint device." The official documentation instructs administrators to use the EICAR test file to verify that devices are properly onboarded and reporting to the service.

4. Carnegie Mellon University, Software Engineering Institute, CERT Coordination Center, "Common Sense Guide to Mitigating Insider Threats, 5th Edition", December 2016. Practice 17, "Deploy solutions for detecting and preventing malicious code," discusses the importance of testing security controls, for which the EICAR file is a standard method. (p. 118).

The most reliable and comprehensive method to test backed-up data is to perform a full restoration to a separate, non-production system. This procedure validates the entire recovery chain: the integrity of the backup media, the functionality of the backup and restore software, and the usability of the recovered data itself. Successfully restoring and verifying the data provides the highest level of assurance that the backup is viable and can be depended upon in a real disaster recovery scenario. While other methods provide partial checks, only a full restore tests the end-to-end process.

A. Verifying the file size is unreliable; it does not confirm data integrity, as a corrupted file can still have the correct size.

B. Confirming the backup service is running only verifies that the backup job was initiated, not that the data was successfully and correctly written.

C. Comparing data hashes is a strong method for verifying data integrity but does not test the restorability of the media or the recovery process itself.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. Section 5.3, "Plan Testing, Training, and Exercises," emphasizes that "Recovery strategies should be tested to validate that they will work as planned." Table 5-2, "Contingency Plan Test, Training, and Exercise Activities," explicitly lists "Restoration of a single system from backup media" as a key testing activity.

2. MIT Computer Science and Artificial Intelligence Laboratory (CSAIL), The Missing Semester of Your CS Education. In the lecture on "Backups," the courseware states, "How do you know your backups work? You have to test them. Try to restore them and see if you get the data you expect." This highlights restoration as the definitive test of a backup's viability.

3. Microsoft, Azure Backup documentation. In the "Best practices for Azure VM backup" guide, Microsoft recommends, "Perform periodic restore drills... Testing the restore process provides confidence in your DR [Disaster Recovery] strategy and validates that your backups are recoverable." This vendor best practice underscores the importance of testing the full restore process.

CIS Control 18, "Penetration Tests and Red Team Exercises," is specifically designed to manage and improve the security lifecycle by actively testing and validating the effectiveness of an enterprise's security controls. This control simulates real-world attacker tactics, techniques, and procedures to measure how well the implemented security measures (technical, physical, and personnel) can detect and respond to an attack. The results provide direct feedback on control gaps and misconfigurations, thereby validating that documented controls are in place and functioning as intended.

A. Controlled Use of Administrative Privilege (CIS Control 6) is a preventive control focused on managing and limiting powerful accounts, not a process for validating all security controls.

B. Account Monitoring and Control (now part of CIS Control 5, Account Management) is an operational control for managing the lifecycle of user accounts, not a validation mechanism for the entire security program.

C. Data Protection (CIS Control 3) is a broad set of protective controls (e.g., encryption, access control) for securing data, not the method used to test and validate those or other controls.

---

1. Center for Internet Security (CIS). (2021). CIS Critical Security Controls v8.

Reference: Page 3, Control 18: Penetration Testing.

Quote/Paraphrase: The overview for Control 18 states its purpose is to "test the effectiveness of an organization’s security controls... by simulating the objectives and actions of an attacker." This directly aligns with the concept of validating that controls are in place and effective. In contrast, Controls 3, 5, and 6 are described as implementing specific safeguards, not testing the overall security posture.

2. Whitman, M. E., & Mattord, H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning.

Reference: Chapter 12, "Security Maintenance," Section on "Vulnerability Assessment and Remediation," pp. 518-520.

Paraphrase: This university-level textbook explains that penetration testing is a primary method for assessing security controls. It is described as a set of security tests that "simulate attacks by a malicious external source" to find and demonstrate vulnerabilities. This process serves to validate the effectiveness of existing defensive controls and the organization's incident response capabilities, which is a core component of managing the security lifecycle.

The principle of least functionality, which is central to CIS Control 9 (Limitation and Control of Network Ports, Protocols, and Services), dictates that systems should be configured to provide only essential capabilities. When an application is no longer needed, the most secure and definitive action is to uninstall it completely. This removes the application's code, its associated services, and any potential vulnerabilities from the host system. Disabling the service or blocking network access are less secure alternatives, as the unused software remains on the system and could be inadvertently or maliciously re-activated.

B. Turning the service off leaves the application installed, creating a risk that it could be re-enabled accidentally or maliciously.

C. Blocking the protocol at the firewall is a network-level control that does not remove the underlying software or vulnerability from the host.

D. Creating a router access list is a network filtering action that, like a firewall rule, fails to address the unnecessary software on the server itself.

1. Center for Internet Security (CIS). (2021). CIS Critical Security Controls v8. Control 04: Secure Configuration of Enterprise Assets and Software. Safeguard 4.1 states, "Establish and Maintain a Secure Configuration Process," which includes processes for "uninstalling or disabling any unnecessary software." Removing the software is the most complete implementation of this safeguard.

2. National Institute of Standards and Technology (NIST). (2008). NIST Special Publication 800-123: Guide to General Server Security. In Section 3.3.1, "Operating System," the guide explicitly states, "Unnecessary services, applications, and network protocols should be disabled or removed... Removing the software is preferred over disabling it because it eliminates the possibility of the software being re-enabled, either accidentally or maliciously."

3. National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control CM-7, "Least Functionality," requires organizations to configure systems to "provide only essential capabilities." The discussion section clarifies that this includes the removal of non-essential software programs and components.

Sender Policy Framework (SPF) is an email authentication method designed to prevent sender address forgery. A domain owner publishes a special DNS record (an SPF record) that lists all the IP addresses of the mail servers authorized to send email on behalf of that domain. When an inbound mail server receives an email, it checks the SPF record of the purported sending domain. If the IP address of the sending server is not on the authorized list, the receiving server can identify the message as potentially spoofed and can subsequently reject it or flag it as spam, thereby decreasing the effectiveness of spoofed email messages.

A. Finger Protocol is an obsolete protocol used to retrieve information about users on a remote system and has no function in email authentication.

C. Network Address Translation (NAT) is a networking method for remapping IP addresses, primarily used for IP conservation and network security, not for authenticating email senders.

D. Internet Message Access Protocol (IMAP) is a standard protocol used by email clients to retrieve email messages from a mail server; it does not validate the sender's identity.

---

1. Kitterman, S. (2014). Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1. RFC 7208, IETF.

Section 1, Introduction: "Email on the Internet can be forged in a number of ways... This document describes the Sender Policy Framework (SPF), a mechanism by which a domain owner can publish a list of servers that are authorized to send email on its behalf. This can be used to detect and reject forged addresses in the SMTP MAIL FROM command."

2. National Institute of Standards and Technology (NIST). (2019). Special Publication 800-177 Revision 1: Trustworthy Email.

Section 3.1, Sender Policy Framework (SPF): "SPF is a widely deployed technology that allows a domain owner to authorize hosts to send mail on behalf of the domain. The domain owner publishes this authorization policy in a special DNS resource record. A receiving mail server can use the policy to determine whether a message was sent from an authorized host." (DOI: https://doi.org/10.6028/NIST.SP.800-177r1)

3. Google Workspace Admin Help. (n.d.). Help prevent spoofing & phishing with SPF. Google.

"How SPF helps prevent spoofing": "Without email authentication, spoofers can more easily send messages that appear to be from your organization... SPF is a standard email authentication method that helps prevent spoofing by letting receiving mail servers check that messages appearing to come from your domain are sent from servers authorized by you." (Retrieved from Google's official documentation for administrators).

A corrective control is implemented to remediate a problem after it has been detected. In this scenario, Network Access Control (NAC) takes action after a host has been identified as infected with a virus. The act of disabling the host's communication is a corrective measure designed to contain the threat and fix the immediate security issue by isolating the compromised system from the network. This action directly addresses and corrects an existing security failure, which is the core function of a corrective control. The other options are preventive controls, which aim to stop an incident from occurring in the first place.

A. Firewall whitelisting is a preventive control that proactively blocks unauthorized network traffic before an incident occurs.

C. Disabling autorun is a preventive system hardening measure intended to stop malware from executing automatically.

D. User security training is a preventive administrative control designed to stop attacks by educating users to avoid them.

1. NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. Appendix F, Security Control Structure, defines control types. Corrective controls are described as actions taken to "identify and correct problems" and "reduce the impact of an incident." NAC quarantine falls under this definition. (Page F-2)

2. NIST Special Publication 800-12 Revision 1, An Introduction to Information Security. Section 5.2, "Types of Controls," states, "Corrective controls are used to remedy the circumstances that caused an unwanted event...". The example of isolating an infected system fits this description perfectly, while firewalls and user training are listed as preventive. (Page 33)

3. MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014. Lecture 1 notes, "Introduction and Threat Models," differentiate security mechanisms. "Responsive" (or corrective) mechanisms like quarantine are contrasted with "Preventive" mechanisms like firewalls, which aim to stop attacks before they succeed. (Lecture 1 Slides, Slide 20)

Enabling event log storage immediately after a system's installation is crucial for establishing a baseline of normal operational activity. This initial set of logs captures the standard processes, services, and configurations of a clean system. During a future security incident, this baseline serves as a reference point, allowing security analysts to more easily and accurately distinguish between normal system behavior and anomalous or malicious activities. Without this baseline, identifying the subtle indicators of a compromise becomes significantly more difficult.

A. Event logs record activities and are used for auditing and forensics; they do not contain the system state needed for restoration, which is the function of backups or system images.

C. While performance logs exist, the primary security purpose of enabling event logging immediately is to establish a behavioral baseline for incident response, not for performance comparison.

D. Logging itself does not inherently identify a pre-installed rootkit. A rootkit is designed to hide its presence, and specialized detection tools are required for its discovery.

1. National Institute of Standards and Technology (NIST) Special Publication 800-92, Guide to Computer Security Log Management.

Reference: Section 2.1, "Reasons for Log Management," Page 2-1.

Quote/Paraphrase: The document states that a key use for logs is to "establish a baseline of normal activity. The baseline can be used to detect trends and to identify activity that is outside of the norm." This directly supports the concept of using initial logs to separate normal from abnormal behavior.

2. Carnegie Mellon University, Software Engineering Institute (SEI), "State of the Practice of Computer Security Incident Response Teams (CSIRTs)."

Reference: Section 4.3.2, "Data Sources," Page 31.

Quote/Paraphrase: The document emphasizes the importance of collecting log data from various sources, including operating systems, to perform analysis. It notes that "understanding what is 'normal' network and system activity" is a prerequisite for detecting anomalies, which requires having a historical record of logs from a known-good state.

3. SANS Institute, "Intrusion Detection and Prevention Systems (IDPS) and Network Forensics."

Reference: SANS SEC503 Course Material (aligned with GIAC GCCC).

Quote/Paraphrase: A core principle taught in SANS security operations courses is "Know normal, find evil." This methodology relies on having a well-established baseline of system and network activity, which begins with logging from the moment a system is deployed, to effectively identify malicious deviations.

The Center for Internet Security (CIS) Controls are a prioritized, prescriptive, and actionable set of technical safeguards designed to help organizations defend against the most common and damaging cyber-attacks. Their development is community-driven and informed by analysis of actual attack data from a wide range of threat sources. This threat-informed approach ensures that the controls focus on the defensive actions that have the greatest impact on improving an organization's security posture against prevalent, real-world threats.

A. While the SANS Institute was the original developer, the controls are now managed by the Center for Internet Security (CIS).

C. The CIS Controls are a standalone framework that can map to and help implement NIST frameworks, but they are not designed as an augmentation.

D. This description is too generic. The defining characteristic of the CIS Controls is their specific prioritization based on current threat data, not general regulations.

1. Center for Internet Security. (2021). CIS Critical Security Controls v8. Page 6, Introduction. "The CIS Controls are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are derived from the most common attack patterns highlighted in leading threat reports and vetted by a community of experts."

2. University of Washington, Office of the CISO. (n.d.). CIS Controls. "The CIS Controls are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks... The CIS Controls are developed, refined, and validated by a community of experts from around the world."

3. Purdue University. (n.d.). Cybersecurity Resources - CIS Controls. "The CIS Controls are a prioritized set of actions to protect your organization and data from known cyber-attack vectors. They are a relatively short, prioritized list of cybersecurity controls."

When implementing a commercial backup solution, enabling encryption is a critical security control. Backups contain a complete, point-in-time copy of sensitive organizational data. If this data is not encrypted at rest on the backup media, it is vulnerable to unauthorized access if the media is lost, stolen, or the storage system is compromised. Most reputable commercial solutions offer strong, standardized encryption (e.g., AES-256), and enabling it is a fundamental step in any secure configuration checklist to ensure data confidentiality.

B. Disable software-level encryption to increase speed of transfer: Disabling encryption sacrifices essential data confidentiality for a potential performance gain, which is an unacceptable security trade-off for sensitive organizational data.

C. Develop a unique encryption scheme: Creating custom cryptographic schemes is a well-known anti-pattern ("don't roll your own crypto") as they are highly likely to contain vulnerabilities that are avoided by using standardized, peer-reviewed algorithms.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Rev. 5).

Page 281, Control SC-28 (Protection of Information at Rest): This control mandates the protection of the confidentiality and integrity of information at rest. The discussion section explicitly notes that encryption is a primary method for achieving this. Backups are a form of information at rest.

2. Amazon Web Services (AWS). (2023). AWS Backup Developer Guide.

Section: Data protection in AWS Backup: The documentation states, "Data protection refers to protecting data while in transit (as it travels to and from AWS Backup) and at rest (while it is stored in AWS data centers)... AWS Backup encrypts your backups at rest." This highlights encryption as a default and essential feature of a commercial backup service.

3. Microsoft Azure. (2023). Azure Backup security features.

Section: Encryption of backup data: The official documentation states, "Encryption protects your data and helps you to meet your organizational security and compliance commitments... By default, all your data is encrypted at rest using service-managed keys." This reinforces that encryption is a standard and necessary component of a secure backup strategy.

4. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308.

Section V-A-1, Design Principle: Least privilege: While an older source, this foundational paper outlines core security principles. Encrypting backups aligns with the principle of least privilege by ensuring that even someone with physical access to the media cannot access the information without the key, thereby restricting access to the data itself. (DOI: 10.1109/PROC.1975.9939)

The screenshot shows a URL Filtering profile on a next-generation firewall (NGFW) configured to block specific web categories, including social networking, web-based email, and peer-to-peer file sharing. This is a direct implementation of a web content filtering policy. Such a measure is designed to protect an organization by preventing users from accessing potentially malicious, unauthorized, or non-business-related websites through their browsers. This action directly aligns with the objectives of CIS Control 9: Email and Web Browser Protections (v8), which focuses on securing against threats from web vectors by controlling the content users can access.

A. Controlled Access Based on the Need to Know: This control (CIS Control 3 in v8) pertains to managing access rights to enterprise assets and data, not filtering general internet web traffic.

B. Limitation and Control of Network Ports, Protocols and Services: This control (CIS Control 12 in v8) focuses on managing network-level (Layer 3/4) access, whereas URL filtering is an application-layer (Layer 7) control.

D. Secure Configuration for Network Devices, such as Firewalls, Routers and Switches: This control (CIS Control 11 in v8) concerns the hardening of the network device itself (e.g., changing default passwords), not the traffic-filtering policies it enforces.

---

1. Center for Internet Security (CIS). (2021). CIS Critical Security Controls v8.

Reference: Page 23, Control 09: Email and Web Browser Protections.

Details: The control's description states its purpose is to "Improve protections and detections of threats from email and web vectors." The configuration shown in the image is a primary method for protecting against web-based threats by filtering and blocking access to specific URL categories.

2. Palo Alto Networks. (2023). PAN-OS® Administrator's Guide 10.2: URL Filtering.

Reference: Section: "URL Filtering Concepts".

Details: Official vendor documentation for a leading NGFW describes URL filtering as a feature to "control access to websites to protect you from malicious websites and to control the sites users can access." The guide explicitly mentions blocking categories like "social-networking" to enforce corporate policy, which directly matches the screenshot and the intent of CIS Control 9.

3. Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. MIT OpenCourseWare.

Reference: Chapter 9, "Security and Protection," Section 9.6.3, "Firewalls."

Details: University courseware on system design explains that modern firewalls (NGFWs) operate at the application layer to inspect and filter content, such as URLs. This capability is used to enforce security policies that go beyond simple port and protocol blocking, directly supporting the protective measures outlined in CIS Control 9.