Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary benefit of integrating account monitoring logs into a SIEM platform?

   • AIt eliminates the need for manual log review
   • BIt automatically resets user passwords when suspicious activity is detected
   • CIt provides centralized visibility and correlation of account events across multiple systems
   • DIt prevents all unauthorized access attempts
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company wants to monitor for unauthorized changes to user accounts, such as privilege escalation or password changes. Which events should be logged and monitored?

   • AOnly password change events.
   • BAll account creation, modification, and deletion events, especially those involving privilege changes.
   • COnly account deletion events.
   • DOnly group membership changes.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization uses a privileged access management (PAM) solution to manage admin credentials. The SIEM receives logs from the PAM system. An analyst notices that a user checked out an admin account, but the subsequent admin session did not include an MFA prompt. What should the analyst do first?

   • AIgnore the event because the PAM system is trusted and the session was logged.
   • BCheck if the user's own account has MFA enabled and whether the user is a known administrator.
   • CImmediately revoke the user's access to the PAM system and reset the admin account password.
   • DVerify whether the PAM solution is configured to require MFA for every session, and check if the session was initiated through a compliant path.
   Reveal Solution Discussion Select an answer first
5. 4application · medium · select all that apply

   A security team is implementing monitoring for privileged account usage. Which of the following activities should be monitored to detect anomalous behavior? (Select all that apply.)

   • AFailed logins to standard user accounts
   • BPrivilege elevation requests
   • CSuccessful logins to privileged accounts
   • DPassword changes for privileged accounts
   • EDelegation of admin rights
   Check answers Discussion Select an answer first
6. 5application · medium

   A security analyst is building a continuous monitoring program for a mid-sized company. The company has 500 user accounts, 20 service accounts, and 10 privileged accounts. The analyst wants to ensure that all account lifecycle events are captured and correlated. Which approach best achieves this goal?

   • AEnable logging on the domain controller for account creation, modification, and deletion events, and forward those logs to the SIEM.
   • BConfigure the SIEM to alert on any failed login attempt for a privileged account.
   • CEnable logging only for privileged account changes, since those pose the highest risk.
   • DUse a script that periodically queries the directory for accounts that have not logged in for 90 days.
   Reveal Solution Discussion Select an answer first