Free GSLC-2020 sample questions

Correct answer: To stop the incident from causing further damage and prevent its spread.

The core purpose of the Containment phase is to limit the scope and magnitude of the incident. From a business perspective, this means stopping the financial, reputational, and operational bleeding. This description is accurate, concise, and directly relates the technical action to its business impact.

Correct answer: False

This statement has the definitions reversed. A 'policy' is the high-level document outlining goals and intent. A 'standard' is a mandatory document that specifies the technologies, configurations, and rules that must be implemented to comply with the policy.

Correct answer: Implement a risk-based prioritization model using CVSS, exploitability, and asset criticality.

The core problem is not the lack of findings, but the inability to act on them. A risk-based prioritization model is the most crucial first step. It allows the team to focus developers' limited time on the vulnerabilities that pose the greatest actual risk to the business, rather than treating all findings equally. This makes the remediation workload manageable and demonstrably reduces risk.

Correct answer: Propose a phased approach starting with establishing a Cloud Center of Excellence (CCoE), developing a cloud security framework based on the Shared Responsibility Model, and prioritizing the re-architecture of key applications using cloud-native services and security controls.

This strategy addresses the root causes of the problem: lack of cloud experience, a flawed migration plan, and compliance concerns. Establishing a CCoE builds internal expertise. Developing a framework based on the Shared Responsibility Model clarifies security roles. Prioritizing re-architecture with cloud-native controls is more secure, scalable, and cost-effective than a simple 'lift-and-shift' of legacy security models. This demonstrates strategic leadership that balances security, compliance, and business agility.

Correct answer: To automate repetitive, manual tasks in the incident response process using playbooks.

The core value of a SOAR platform is automation and orchestration. It integrates with other security tools (like SIEM, EDR, firewalls) and uses predefined 'playbooks' to automate sequences of actions, such as enriching alerts, quarantining hosts, or blocking IP addresses. This frees up analysts from repetitive tasks to focus on more complex investigations.

Correct answer: Interactive Application Security Testing (IAST)

IAST is the methodology that combines elements of both SAST and DAST. It works by deploying an agent that instruments the application code. As automated or manual dynamic tests are performed, the IAST agent observes the application's behavior from the inside, allowing it to pinpoint the exact line of code responsible for a vulnerability with high accuracy.

Correct answer: Endpoint Detection and Response (EDR) with behavioral analysis

Traditional AV is ineffective against zero-day and fileless attacks because they lack known signatures. EDR solutions excel here by focusing on behavioral analysis. They monitor system processes, memory, and network connections for anomalous activities (TTPs - Tactics, Techniques, and Procedures) indicative of an attack, regardless of whether a malicious file is present. This makes EDR critical for detecting modern, sophisticated threats.

Correct answer: Gaining executive sponsorship and clearly communicating the policy and its consequences.

A policy without executive sponsorship and clear communication is merely a suggestion. For an AUP to be effective, it must have visible support from leadership, be clearly and regularly communicated to all employees in understandable language, and have well-defined, consistently applied consequences for violations. This creates a culture of accountability and ensures the policy is taken seriously.

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) is specifically structured around the five core functions: Identify, Protect, Detect, Respond, and Recover. This structure provides a high-level, strategic view of an organization's cybersecurity risk management capabilities and is widely used to communicate security posture and program needs to business executives.

Correct answers: Regularly scheduled phishing simulations with metrics on click rates and reporting rates.; A clear process for employees to report suspicious emails and incidents.; Role-based training tailored to specific risks faced by different departments (e.g., finance, HR).

Phishing simulations are a practical way to test and reinforce learning, and tracking metrics like click and report rates provides clear data on program effectiveness and areas for improvement.

An effective program must empower employees to act. A simple, well-communicated reporting process turns every employee into a potential sensor for the security team.

Generic, one-size-fits-all training is less effective. A mature program provides targeted education based on the unique risks and access levels of different roles, making the content more relevant and impactful.