Discuss GIAC GCCC Exam Topic 8 Question 32

Acme Corporation is doing a core evaluation of its centralized logging capabilities. Which of the following scenarios indicates a failure in more than one CIS Control?

AThe loghost is missing logs from 3 servers in the inventory

BThe loghost is receiving logs from hosts with different timezone values

CThe loghost time is out-of-sync with an external host

DThe loghost is receiving out-of-sync logs from undocumented servers

Suggested Answer: D

Get Premium GCCC Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Jess 11 months ago

Wait, are we sure A is a failure in multiple controls? Seems like just one to me.

Scarlet 11 months ago

B seems minor, but it could cause confusion later on.

Glenn 11 months ago

C is a classic mistake, time sync is crucial for logs.

Asha 11 months ago

I think D is worse, undocumented servers can lead to major issues.

Jose 11 months ago

A is definitely a problem, missing logs is a big deal.

Micaela 12 months ago

Option B seems less critical to me, but I guess different timezones could still cause issues with log analysis. Not sure if it counts as multiple failures though.

Samira 12 months ago

I practiced a similar question where missing logs pointed to control failures. So, I'm leaning towards option A being a strong candidate.

Filiberto 12 months ago

I'm not entirely sure, but I remember something about time synchronization being important for logs. Maybe option C is relevant here?

Lorriane 1 year ago

I think option D might indicate a failure in multiple CIS Controls, especially if those servers are undocumented.

Matilda 1 year ago

I've got a good feeling about this one. I'm pretty sure it's the IP address change that requires the neighbor relationship to be re-established. The other options don't seem as critical for the neighbor connection.

Maddie 1 year ago

Okay, let me see here. I remember that the WEM Agent can be installed on the Citrix Workspace Environment Management Infrastructure Services server, so I'll go with option B.

Filiberto 1 year ago

I remember studying the steps for image upgrades, and I think using a different kickstart image might be the right move here.

Emily 1 year ago

Okay, RAID-10 makes sense to me. It's got the redundancy of RAID-1 with the striping of RAID-0. I'm confident that's the right answer.

GIAC GCCC Exam - Topic 8 Question 32 Discussion