In CIS Critical Security Controls version 8.1, the 18 Controls are organized into three implementation groups. Which group is specifically designed for 'essential hygiene' and represents the minimum standard of information security for all organizations?

Under CIS Control 11: Data Recovery, what is the primary requirement for ensuring that backups are protected from ransomware and other integrity attacks in a CIS v8.1 environment?

Under CIS Control 1: Inventory and Control of Enterprise Assets, what is the primary distinction between a 'Passive Asset Discovery' tool and an 'Active Asset Scanning' tool as defined in CIS Safeguards?

An organization recently discovered that an unmanaged legacy server was connected to the production network without authorization, which then became the entry point for a ransomware attack. According to CIS Control 1 (Inventory and Control of Enterprise Assets), which process should the organization have implemented to prevent this specific scenario?

A financial services firm is reviewing its data protection strategies following an audit. They discovered that several database administrators have permanent, standing administrative access to sensitive customer records, even when not performing maintenance tasks. Which CIS Control and corresponding action should be prioritized to mitigate this risk of unauthorized data access?

An IT security team is investigating a breach where the attacker gained access to a workstation and moved laterally across the network for weeks without detection. The post-incident review reveals that while logs were being generated by the servers, they were only stored locally on each machine and were periodically overwritten due to storage limits. Which CIS Control and primary action should the team implement to ensure better detection and forensics for future incidents?

An employee at a healthcare provider accidentally downloaded a malicious file from a personal webmail account, which executed a script that changed the system's DNS settings. This allowed the attacker to redirect all subsequent traffic to a phishing site. According to CIS Control 9 (Email and Web Browser Protection), which safeguard would most effectively prevent this specific redirection at the network level?

An internal audit reveals that several software applications used by the accounting department are end-of-life (EOL) and no longer receive security patches, posing a significant risk to the organization. According to CIS Control 2 (Inventory and Control of Software Assets), what is the most appropriate first step to manage this risk?

An insurance company handles vast amounts of Sensitive Personal Information (SPI). During a security assessment, it was discovered that while the production database is secure, developers are frequently using unmasking copies of real customer data in their testing environments. Which CIS Control 3 (Data Protection) safeguard should be prioritized to rectify this?

An organization is updating its remote access policy. They want to ensure that if a technician's credentials are stolen, the attacker still cannot access the corporate network remotely. According to CIS Control 6 (Access Control Management), which safeguard is most critical for this objective?

An organization experiences a security incident where a former employee’s credentials were used to access a cloud-based file share two weeks after they left the company. The investigation found that while their internal network account was disabled, their cloud-specific account remained active. Which CIS Control 6 (Access Control Management) safeguard specifically addresses this failure?

An organization is concerned that employees are using their corporate laptops to visit high-risk websites during lunch breaks, leading to drive-by download attacks. To address this, the IT team decides to implement a solution that forces all web traffic through a secure web gateway that inspects content and blocks malicious sites. Which CIS Control and specific action are they implementing?

An IT department is struggling with 'configuration drift', where servers that were initially secure have gradually become vulnerable due to manual changes and the addition of unauthorized services. According to CIS Control 4 (Configuration Management), which also interacts with CIS Control 2, what is the best automated approach to ensure that only authorized software is running and systems remain in a known-good state?

An organization is updating its data protection strategy to align with CIS Control 3. They have identified that several legacy systems contain sensitive PII, but these systems do not support modern encryption protocols for data at rest. According to the CIS guidelines for Data Protection, which of the following actions should the security team prioritize to mitigate the risk of unauthorized access or disclosure of this sensitive data?

An enterprise is undergoing a security audit regarding CIS Control 3 (Data Protection). The auditor discovers that while the organization uses automated tools to identify sensitive data, they do not have a defined process for disposing of data that has reached the end of its legal retention period. Which specific Safeguard within CIS Control 3 should the organization implement to address this finding?

A financial services firm is implementing CIS Control 3 and wants to prevent unauthorized movement of sensitive customer data across its network perimeters and to external portable storage devices. Which technical control is specifically recommended within CIS Control 3 to monitor and block the transmission of sensitive data based on content and predefined patterns?

An organization is looking to mature its data protection capabilities by ensuring that sensitive data transmitted over insecure networks is not intercepted. According to CIS Control 3, which approach should be taken to ensure the cryptographic integrity and confidentiality of data in transit?

An enterprise is attempting to meet the requirements of CIS Control 3 by enhancing their 'Data Identification and Classification' efforts. The IT team has deployed an automated tool to scan file shares for sensitive information, but the tool is generating a high number of false positives. According to the guidance in SANS SEC566 and CIS Control 3, what is the most critical first step the organization should have taken before deploying the automated discovery tool?

An organization is configuring its cloud storage buckets to comply with CIS Control 3. The security team must ensure that any sensitive data accidentally uploaded to a public-facing container is not accessible to unauthorized parties. According to the Safeguards in CIS Control 3, which technical control is most effective at protecting the confidentiality of the data even if the storage container's access permissions are misconfigured to be 'Public'?

A healthcare organization is reviewing its compliance with CIS Control 3 (Data Protection) and identifies that developers are using production databases containing Patient Health Information (PHI) to test new application features. To align with CIS Safeguards regarding the protection of sensitive data in non-production environments, which of the following is the most appropriate action?

A multinational corporation is implementing CIS Control 3 and needs to ensure that access to sensitive financial records is restricted exclusively to the authorized finance team. According to the CIS Safeguards, which process should be integrated with Data Protection to ensure that only individuals with a 'need-to-know' can access specific data classifications?

A mid-sized company is adopting the CIS Controls and is currently focusing on Control 3.3, 'Configure Data Access Control Lists.' After successfully classifying their data, they discover that their primary file server has 'Everyone: Read' permissions on a folder containing sensitive project specifications. Which action best fulfills the intent of this specific Safeguard within Control 3?

A legal firm is implementing CIS Control 3 (Data Protection) and is focusing on Safeguard 3.6, which involves 'Encrypting Data on Removable Media'. A recent audit found that employees frequently use USB flash drives to transport case files to remote courtrooms. Which of the following is the most compliant method to meet this CIS requirement?

An enterprise is reviewing its access control logs and discovers that several former employees still have active accounts with access to sensitive customer data. According to CIS Control 4 (Safe Safeguard 4.2), which specific process should the security team implement to resolve this issue and prevent its recurrence?

A financial firm recently experienced a credential stuffing attack where an attacker gained access to a standard user account and attempted to perform administrative tasks. The audit revealed that the user had remained logged in on a shared workstation for 48 hours without re-authentication. Which CIS Control 4 safeguard would best mitigate this risk by limiting the window of opportunity for an attacker?

A mid-sized company discovered that several junior IT administrators are using their daily-use accounts to perform high-level configuration changes on the core network switches. This practice violates the principle of least privilege as defined in CIS Control 4. Which action should the organization take to align with Safeguard 4.3?

A healthcare provider is attempting to strengthen its Access Management (CIS Control 4) after a breach involving a remote worker. The investigation showed the attacker used a stolen password to access the Virtual Private Network (VPN). To comply with CIS Safeguard 4.5, which control remains the most critical for all remote access and administrative accounts?

An organization is migrating its local directory services to a cloud-based environment. To maintain compliance with CIS Control 4 (Access Management), the security architect insists that all authentication requests must be handled through a single, central provider rather than allowing individual cloud applications to manage their own local user databases. Which CIS Safeguard is being implemented?

An IT manager notices that the help desk team is manually creating user accounts across five different platforms every time a new employee is hired, leading to inconsistent naming conventions and forgotten permissions. According to CIS Control 4.1, which strategy should the manager implement to streamline this and ensure a single 'source of truth' for identities?

A security auditor discovers that a company allows its developers to use the same account for writing code, checking email, and performing production database schema changes. To align with CIS Control 4 (Safe Safeguard 4.3), what specific measure must the company take regarding these administrative privileges?

An enterprise is looking to reduce the 'attack surface' by identifying and removing accounts that have not been used for over 90 days. According to CIS Control 4 (Safe Safeguard 4.7), which practice should the organization implement to manage the lifecycle of these credentials correctly?

An organization is updating its security policy to address 'dormant accounts' that belong to contractors who have completed their projects but were never formally offboarded. According to CIS Control 4.7, what is the recommended frequency for reviewing and disabling these accounts?

An organization is configuring its Cloud Infrastructure and discovers that a specific service account is being used by multiple developers to automate server deployments. According to CIS Control 4 (Access Management), which action should the organization take to ensure accountability and follow Safeguard 4.4?

According to CIS Control 4: Secure Configuration of Enterprise Assets and Software, why is it critical to disable or remove dormant accounts that have not been used for a period of 45 days or more?

In accordance with CIS Control 4 (Account Management), what is the recommended practice for managing administrative privileges within an enterprise?

Regarding CIS Control 4, which security measure is specifically recommended for all access to enterprise assets, whether managed on-premises or by a third-party provider, to enhance authentication security?

Which specific action does CIS Control 4 recommend taking immediately upon the termination or transformation of an employee's role within the enterprise?

Under CIS Control 4 (Account Management), what is the primary purpose of 'Establish and Maintain an Inventory of Accounts'?

Which specific sub-control within CIS Control 4 (Account Management) addresses the unique risks associated with service accounts such as those used by automated processes and applications?

Which of the following describes the 'Unique Identifiers' requirement as defined in CIS Control 4 for Account Management?

Which specific technical measure is advocated by CIS Control 4 for managing administrative accounts and ensuring they are not used for non-administrative tasks such as web browsing or email?

Which of the following describes the 'Centralized Account Management' principle recommended in CIS Control 4?

Which specific implementation in CIS Control 4 (Account Management) helps mitigate the risk of 'pass-the-hash' attacks and other credential theft techniques specifically for local administrative accounts on workstations?