Discuss GIAC GCCC Exam Topic 7 Question 9

An organization has created a policy that allows software from an approved list of applications to be installed on workstations. Programs not on the list should not be installed. How can the organization best monitor compliance with the policy?

APerforming regular port scans of workstations on the network

BAuditing Active Directory and alerting when new accounts are created

CCreating an IDS signature to alert based on unknown ''User-Agent '' strings

DComparing system snapshots and alerting when changes are made

Suggested Answer: C

Get Premium GCCC Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Rosann 11 months ago

IDS signatures for unknown User-Agent strings sounds a bit overkill, right?

Ronny 11 months ago

Wait, can you really detect all unauthorized installs just by snapshots?

Tamala 12 months ago

Auditing Active Directory won't really help with software compliance.

Reyes 12 months ago

I think comparing system snapshots is the best way to monitor changes.

Alethea 12 months ago

Regular port scans can help catch unauthorized software.

Zena 1 year ago

I’m a bit confused about the IDS option. Would creating a signature for unknown User-Agent strings really help with monitoring installed applications?

Tabetha 1 year ago

I feel like I’ve seen a question similar to this before, and I think monitoring changes directly is key, so D could be the best choice.

Arminda 1 year ago

I'm not entirely sure, but I remember something about port scans being more about network traffic than installed software, so A might not be right.

Laurel 1 year ago

I think option D makes the most sense since comparing system snapshots can directly show if unauthorized software has been installed.

Noel 1 year ago

Hmm, I'm a bit unsure on this one. I'll need to re-read the question and the answer choices carefully to make sure I understand the "data minimization" principle correctly.

Maynard 1 year ago

Hmm, I'm a bit confused here. The question mentions a CIFS share, so I'm not sure if Kerberos would be the right thing to look at. Maybe I should focus more on the data LIF and the node it's on.

Tracie 1 year ago

Okay, I think I've got this. I'll use the `trivy image` command to scan the two images, filter for high and critical severities, and redirect the output to the specified file. Should be a pretty straightforward task.

GIAC GCCC Exam - Topic 7 Question 9 Discussion