Host OS Monitoring GCTD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst notices a cloud VM with a sudden spike in CPU usage and an unusual process named 'svch0st' running from /tmp. The process is not in the approved application whitelist. The analyst needs to confirm whether this is a legitimate process or a potential threat, and then take immediate action. What should the analyst do first?

   • AReboot the VM to clear the process from memory.
   • BAdd the process to the whitelist to prevent future alerts.
   • CKill the process immediately to stop any malicious activity.
   • DCheck the process's parent process, command-line arguments, and associated network connections.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key host-level metric that should be collected to monitor the performance and health of a cloud virtual machine?

   • ANumber of load balancer rules
   • BCloud provider's data center temperature
   • CNetwork latency between cloud regions
   • DCPU utilization percentage
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is monitoring running processes and services on a cloud host important for security?

   • AIt replaces the need for file integrity monitoring.
   • BIt ensures that the cloud provider's hypervisor is running the latest version.
   • CIt helps identify unauthorized or malicious processes that may indicate a compromise.
   • DIt automatically stops any process that uses high CPU.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is tuning a host-based IDS on a web server. The IDS is generating alerts for legitimate administrative activity, causing alert fatigue. The analyst needs to reduce false positives without missing real threats. Which tuning strategy is most effective?

   • AIgnore all alerts from the web server.
   • BDisable the IDS during business hours.
   • CIncrease the alert threshold to only alert on critical events.
   • DCreate exceptions for known administrative accounts and processes.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security engineer is evaluating host-based intrusion detection for a mixed environment of Linux and Windows VMs. The solution must detect kernel-level rootkits and integrate with their existing SIEM. They have a limited budget and prefer open-source tools. Which solution best meets these requirements?

   • ADeploy a commercial HIDS like CrowdStrike Falcon.
   • BUse only cloud-native services like AWS GuardDuty.
   • CDeploy OSSEC on each VM and forward alerts to the SIEM.
   • DUse Sysmon on Windows and auditd on Linux, forwarding logs to the SIEM.
   Reveal Solution Discussion Select an answer first