A security administrator is implementing file integrity monitoring on a critical Linux server. They need to detect changes to /etc/passwd and /etc/shadow, but they also want to minimize false positives from normal system updates. Which configuration approach is best?

Monitor the files and alert on any change, regardless of source.

Only monitor the files manually on a weekly basis.

Disable FIM during system update windows.

Monitor the files with a FIM tool and whitelist known update processes.

A security team deploys a host-based intrusion detection system (HIDS) on cloud VMs. The HIDS generates an alert for a process that is attempting to bind to a high-numbered port. The process is a known legitimate application. What should the analyst do to reduce false positives while maintaining detection capability?

Increase the alert threshold for all port-binding events

Disable the HIDS rule for high-numbered ports

Create an exception for the specific process and port combination

Move the application to a different VM to avoid the alert

A security team wants to be notified immediately when a critical host process stops running on a Linux VM. They have a monitoring agent that can run custom scripts. Which configuration best meets this requirement?

Create a script that checks the process status and sends an alert if it is not running, and configure it to run every minute.

Set up a daily cron job to check the process and email the team.

Review system logs at the end of each week.

Monitor CPU usage and alert if it drops below a threshold.

Which of the following is a key host-level indicator that a new, unexpected service has been installed on a cloud VM?

A new service appears in the list of running services that is not part of the baseline.

The VM's public IP address changes.

The VM's disk size increases automatically.

The cloud provider sends a billing alert.

A cloud security team is deciding whether to rely solely on cloud-provider-level monitoring (e.g., AWS CloudWatch, Azure Monitor) or also deploy host-based monitoring agents on their VMs. Which statement best justifies the need for host OS monitoring?

Host OS monitoring is only needed for compliance, not for security

Cloud-level monitoring is sufficient for all security monitoring needs

Host OS monitoring is redundant because cloud providers monitor the guest OS for you

Host OS monitoring provides visibility into guest OS events, processes, and file integrity that cloud-level monitoring cannot see

GIAC Cloud Threat Detection

Domain 2Objective 1

Host OS Monitoring GCTD Practice Questions (Page 8)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 36–40

36expert · hard
A security administrator is implementing file integrity monitoring on a critical Linux server. They need to detect changes to /etc/passwd and /etc/shadow, but they also want to minimize false positives from normal system updates. Which configuration approach is best?
Select an answer first
37application · medium
A security team deploys a host-based intrusion detection system (HIDS) on cloud VMs. The HIDS generates an alert for a process that is attempting to bind to a high-numbered port. The process is a known legitimate application. What should the analyst do to reduce false positives while maintaining detection capability?
Select an answer first
38application · medium
A security team wants to be notified immediately when a critical host process stops running on a Linux VM. They have a monitoring agent that can run custom scripts. Which configuration best meets this requirement?
Select an answer first
39foundation · easy
Which of the following is a key host-level indicator that a new, unexpected service has been installed on a cloud VM?
Select an answer first
40application · medium
A cloud security team is deciding whether to rely solely on cloud-provider-level monitoring (e.g., AWS CloudWatch, Azure Monitor) or also deploy host-based monitoring agents on their VMs. Which statement best justifies the need for host OS monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.