GIAC Exam GCCC Topic 5 Question 59 Discussion

Actual exam question for GIAC's GCCC exam

Question #: 59
Topic #: 5

An organization has created a policy that allows software from an approved list of applications to be installed on workstations. Programs not on the list should not be installed. How can the organization best monitor compliance with the policy?

APerforming regular port scans of workstations on the network

BAuditing Active Directory and alerting when new accounts are created

CCreating an IDS signature to alert based on unknown ''User-Agent '' strings

DComparing system snapshots and alerting when changes are made

Show Suggested Answer

Suggested Answer: C

by Leeann at Sep 15, 2024, 02:44 AM

Limited Time Offer

25%

Off

Get Premium GCCC Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Glennis

2 months ago

I'm with Marsha on this one. Tracking changes to the system image is the most straightforward and effective way to ensure compliance.

upvoted 0 times

...

Rory

2 months ago

Haha, option B is a classic IT admin move - just audit Active Directory and freak out every time a new account is created. I'd rather not deal with that many false positives.

upvoted 0 times

Charolette

1 months ago

C) Creating an IDS signature to alert based on unknown ''User-Agent '' strings

upvoted 0 times

...

Audra

1 months ago

B) Auditing Active Directory and alerting when new accounts are created

upvoted 0 times

...

Leigha

1 months ago

A) Performing regular port scans of workstations on the network

upvoted 0 times

...

Valentine

2 months ago

Don't you think option C is a bit too technical? Using an IDS signature to alert on unknown User-Agent strings seems like overkill for this scenario.

upvoted 0 times

Margo

1 months ago

User 3: Yeah, I think option D would be easier to implement and monitor compliance with the policy.

upvoted 0 times

...

Bettina

1 months ago

User 2: I think option D might be a better choice, comparing system snapshots seems more practical.

upvoted 0 times

...

Bev

2 months ago

I agree, option C does seem a bit too technical.

upvoted 0 times

...

Rikki

2 months ago

I personally think option A could also be useful for monitoring unauthorized software installations.

upvoted 0 times

...

Doug

2 months ago

I'd go with option A. Performing regular port scans can help identify any unauthorized applications running on the workstations.

upvoted 0 times

...

Marsha

2 months ago

Option D makes the most sense to me. Comparing system snapshots and alerting on changes is the best way to monitor compliance with the approved software policy.

upvoted 0 times