16. David spent the past week moving from computer to computer installing an update to the Fazz Reader software. It was boring work, but at least he got to listen to music. Upon completing this project he grabbed a double-mocha iced latte and prepared to surf the web for an hour before going home for the weekend. While reading the news he discovered that yet another update to the Fazz Reader software had been released in response to a significant vulnerability. That weekend, after re-examining his life choices, David concluded he needed to implement which CIS subcontrol?

		3.5 Deploy Automated Software Patch Management Tools
		7.5 Subscribe to a URL-Categorization Service
		3.6 Compare Back-to-Back Vulnerability Scans
		6.2 Activate Audit Logging

17. A contractor working on a project for the Fortend Corporation was attempting to resolve an issue with tangled cables within a rack in the machine room. As part of this effort, the contractor moved a server's network cable from one switch port to another and the server was unable to establish a new connection. When the contractor returned the cable to its original port, the server successfully connected. Operations staff arrived to investigate the outage and informed the contractor the switch did not recognize the server on that port. This is an example of which CIS subcontrol?

		11.6 Use Dedicated Workstations for All Network Administrative Tasks
		1.7 Deploy Port Level Access Control
		14.2 Enable Firewall Filtering Between VLANs
		1.1 Use an Active Discovery Tool

18. In order to support vulnerability scans, the Information Security Office added a special account to the configuration of all workstations. This account has administrative privileges because the vulnerability scans need to be able to scan all parts of the system. Desktop support technicians discovered the credentials to login to that special account and sometimes use those credentials to login and solve problems. Which CIS subcontrol did the Information Security Office failed?

		3.5 Deploy Automated Software Patch Management Tools
		17.1 Perform a Skills Gap Analysis
		3.3 Protect Dedicated Assessment Accounts
		9.3 Perform Regular Automated Port Scans

19. When Vivaan went to login, he noticed a quick reminder that HIPAA data had to either be encrypted or de-identified when stored. The reminder is an example of a part of which CIS control?

		8.0 Malware Defenses
		19.0 Incident Response and Management
		12.0 Boundary Defense
		17.0 Implement a Security Awareness and Training Program

20. You are called into consult on an issue where the virtual machine environment halts all execution at 3 AM for no apparent reason. You ask to review the log files for the minutes leading up to that time. What CIS control are you hoping will provide insight?

		2.0 Inventory and Control of Software Assets
		6.0 Audit Logs
		3.0 Continuous Vulnerability Management
		19.0 Incident Response and Management