GIAC Exam GCCC Topic 6 Question 40 Discussion

Actual exam question for GIAC's GCCC exam

Question #: 40
Topic #: 6

[All GCCC Questions]

An organization has implemented a policy to continually detect and remove malware from its network. Which of the following is a detective control needed for this?

AHost-based firewall sends alerts when packets are sent to a closed port

BNetwork Intrusion Prevention sends alerts when RST packets are received

CNetwork Intrusion Detection devices sends alerts when signatures are updated

DHost-based anti-virus sends alerts to a central security console

Show Suggested Answer

Suggested Answer: C

by Bette at Jan 26, 2024, 10:55 PM

Limited Time Offer

25%

Off

Get Premium GCCC Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Shasta

1 months ago

Option D is the clear winner here. Centralized monitoring and alerting from host-based antivirus is the textbook detective control for this scenario.

upvoted 0 times

...

Cherilyn

1 months ago

I'm gonna go with E) The organization should just unplug the whole network. No malware if there's no network, right?

upvoted 0 times

...

Kristal

1 months ago

D, definitely D. Host-based anti-virus sending alerts to a central console is the way to go. Gotta keep that malware under control!

upvoted 0 times

Sylvie

8 days ago

I think Network Intrusion Detection devices sending alerts when signatures are updated could also be helpful in detecting malware.

upvoted 0 times

...

Santos

20 days ago

I agree, having alerts sent to a central console makes it easier to monitor and respond to malware threats.

upvoted 0 times

...

Christiane

1 months ago

Haha, I bet the correct answer is C. Network Intrusion Detection devices sends alerts when signatures are updated. That's the most IT-sounding answer, so it's gotta be right!

upvoted 0 times

Celia

4 days ago

User 2: I disagree, I believe the correct answer is D) Host-based anti-virus sends alerts to a central security console

upvoted 0 times

...

Lindsey

18 days ago

User 1: I think the answer is A) Host-based firewall sends alerts when packets are sent to a closed port

upvoted 0 times

...

Lanie

2 months ago

But wouldn't detecting malware require monitoring network traffic, which is why C) makes more sense?

upvoted 0 times

...

Lavelle

2 months ago

I'm going with B. Network Intrusion Prevention sends alerts when RST packets are received. That seems like a good way to detect and respond to potential malware activities.

upvoted 0 times

Latia

1 months ago

I agree, having alerts sent to a central console can help with centralized monitoring and response.

upvoted 0 times

...

Micaela

1 months ago

I think D is a good option too. Host-based anti-virus sends alerts to a central security console.

upvoted 0 times

...

Simona

2 months ago

I think D could also be a good choice, with host-based anti-virus sending alerts to a central security console.

upvoted 0 times

...

Trinidad

2 months ago

I agree, B sounds like a good option for detecting malware.

upvoted 0 times

...

Keshia

2 months ago

I disagree, I believe the answer is D) Host-based anti-virus sends alerts to a central security console.

upvoted 0 times

...

Lanie

2 months ago

I think the answer is C) Network Intrusion Detection devices sends alerts when signatures are updated.

upvoted 0 times

...

Albert

2 months ago

I'm not sure, but I think C) Network Intrusion Detection devices sends alerts when signatures are updated could also be a good detective control.

upvoted 0 times

...

Thurman

2 months ago

I agree with Tanja. Having alerts sent to a central security console would help in detecting and removing malware efficiently.

upvoted 0 times

...

Emile

2 months ago

I think the correct answer is D. Host-based anti-virus sends alerts to a central security console. This is a detective control that continuously monitors for and detects malware on the network.

upvoted 0 times