GIAC (SANS)GIAC Continuous Monitoring Certification
The GIAC Continuous Monitoring (GMON) certification validates your ability to build, monitor, and adapt defenses for real-time visibility. It proves you can deter intrusions, detect anomalous activity, and implement network security monitoring, continuous monitoring, and continuous diagnostics and mitigation. This credential is for security architects, senior security engineers, SOC analysts, and technical managers who defend enterprise networks.
739 practice questions · Updated 2026-07-30
7Domains
17Objectives
118Concepts
739Questions
GMON Curriculum
Every domain, objective, and concept the GMON exam measures.
- Cyber Defense Principles
- Security Architecture Principles
- Security Architecture Components
- Security Architecture Layers
- Security Architecture Design Patterns
- Security Architecture Frameworks
- Security Architecture and Monitoring Integration
- Threat Informed Defense Definition
- Threat Intelligence Integration
- Adversary Emulation
- Detection Engineering
- Continuous Improvement Cycle
- Network Security Monitoring Tools Overview
- Packet Capture Tools
- Flow Analysis Tools
- Intrusion Detection and Prevention Systems
- Security Information and Event Management (SIEM)
- Network Traffic Analysis Tools
- Log Management Tools
- Threat Intelligence Integration
- Alerting and Reporting
- NIDS vs NIPS vs NGFW
- Detection and Prevention Mechanisms
- Inline vs Passive Deployment
- NGFW Features
- Rule and Policy Configuration
- Alerting and Logging
- Evasion Techniques and Countermeasures
- Performance and Tuning
- Perimeter Protection Device Types
- Device Placement and Segmentation
- Rule and Policy Configuration
- Monitoring and Logging
- Device Health and Performance
- Response and Remediation
- Proxy Fundamentals
- Proxy Deployment Models
- Proxy Logging and Data Collection
- Proxy Security Controls
- SIEM Fundamentals
- SIEM Data Ingestion
- Correlation and Alerting
- SIEM Use Cases for Proxies
- Integration of Proxies and SIEM
- HIDS Fundamentals
- HIDS Detection Methods
- HIDS Deployment and Configuration
- HIPS Fundamentals
- HIPS Prevention Mechanisms
- HIPS Policy and Rule Management
- Endpoint Firewall Fundamentals
- Endpoint Firewall Configuration
- Integration of HIDS/HIPS and Endpoint Firewalls
- Monitoring and Alerting
- Device inventory and asset management
- Device health and performance monitoring
- Device configuration and compliance monitoring
- Device logging and event collection
- Device alerting and incident response
- Software Inventory Fundamentals
- Inventory Data Collection Methods
- Software Inventory Analysis
- Application Control Principles
- Application Control Implementation
- Application Control Monitoring and Maintenance
- Configuration Monitoring Fundamentals
- Configuration Baseline Establishment
- Configuration Change Detection
- Configuration Compliance Assessment
- Configuration Monitoring Tools
- Configuration Monitoring Data Analysis
- Configuration Monitoring Integration
- Configuration Monitoring Reporting and Remediation
- Discovery Scanning Fundamentals
- Vulnerability Scanning Fundamentals
- Scanning Tools and Techniques
- Scanning Frequency and Scheduling
- Scanning Scope and Authorization
- Interpreting Scan Results
- Prioritizing Remediation
- Integrating Scanning with CM Processes
- Patch Management Process
- Vulnerability Scanning and Assessment
- Patch Prioritization Strategies
- Secure Baseline Configuration
- Configuration Management and Enforcement
- Compliance Monitoring and Reporting
- Change Management Integration
- Automation of Patching and Configuration
- Handling Exceptions and Deviations
- Continuous Improvement of Patch and Baseline Processes
- Account Monitoring Fundamentals
- Privilege Monitoring
- Authentication Monitoring
- Account Lifecycle Monitoring
- Identity and Access Monitoring Integration
- Attack Technique Identification
- Attack Lifecycle Analysis
- Tactics, Techniques, and Procedures (TTPs)
- Exploit Analysis Fundamentals
- Malware Behavior Analysis
- Attack Vector Assessment
- Detection and Response Alignment
- Exploit Lifecycle
- Vulnerability Analysis
- Exploit Development
- Exploit Execution
- Post-Exploitation Techniques
- Exploit Detection and Mitigation
- Encryption Fundamentals
- Symmetric vs. Asymmetric Encryption
- TLS/SSL Protocols
- IPsec and VPNs
- Encryption Key Management
- Encryption Algorithms and Cipher Suites
- Encryption in Network Protocols
- Compliance and Regulatory Requirements
- Monitoring and Troubleshooting Encrypted Traffic
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GMON, so none is invented.