A security analyst is tuning authentication monitoring for a large organization. They want to reduce false positives while still detecting brute-force attacks. Which approach is most effective?

Alert on any failed login attempt for privileged accounts only.

Alert only when the number of failed attempts for a single account exceeds a threshold within a short time window.

Disable alerts for failed logins and rely on successful login anomalies.

Alert on any failed login attempt for any account.

A company is integrating its IAM system with a SIEM. The IAM system sends events for user provisioning, deprovisioning, and role changes. The SIEM also ingests authentication logs. The security team wants to detect when a user's role is changed to a privileged role and then the user performs a privileged action. Which correlation would best detect this?

Alert when a role change to a privileged role is followed by a successful authentication and a privileged action within a short time window.

Alert on any role change to a privileged role.

Alert on any privileged action performed by any user.

Alert on any successful authentication by a user with a privileged role.

An organization is migrating to a new IAM system. The security team wants to ensure that no orphaned accounts are left behind in the old system. Which approach is most effective?

Disable all accounts in the old system after the migration is complete.

Monitor the old system's logs for any login attempts after the migration.

Require all users to re-authenticate in the new system within 30 days.

Run a script that compares the user lists from the old and new IAM systems and flags any accounts that exist only in the old system.

A company has a policy that all user accounts must be disabled within 24 hours of termination. The IAM system automatically disables accounts, but the security team has found that some accounts remain active. They want to detect these failures. Which approach is most effective?

Alert on any account that has a password older than 90 days.

Alert on any account that has not logged in for 30 days.

Alert on any account that is a member of the Domain Admins group.

Compare the HR termination feed with the IAM account status daily and alert on any discrepancy.

What is the primary purpose of auditing privileged access in an organization?

To detect and investigate unauthorized or anomalous use of elevated permissions

To reduce the number of privileged accounts in the organization

To ensure that privileged users can access all systems without interruption

To automate the creation of new privileged accounts

GIAC Continuous Monitoring Certification

Domain 5Objective 1

Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 5)

Part of the Identity and Access Monitoring domain, which makes up ~5% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~4–6 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 21–25

21application · medium
A security analyst is tuning authentication monitoring for a large organization. They want to reduce false positives while still detecting brute-force attacks. Which approach is most effective?
Select an answer first
22expert · hard
A company is integrating its IAM system with a SIEM. The IAM system sends events for user provisioning, deprovisioning, and role changes. The SIEM also ingests authentication logs. The security team wants to detect when a user's role is changed to a privileged role and then the user performs a privileged action. Which correlation would best detect this?
Select an answer first
23expert · hard
An organization is migrating to a new IAM system. The security team wants to ensure that no orphaned accounts are left behind in the old system. Which approach is most effective?
Select an answer first
24expert · hard
A company has a policy that all user accounts must be disabled within 24 hours of termination. The IAM system automatically disables accounts, but the security team has found that some accounts remain active. They want to detect these failures. Which approach is most effective?
Select an answer first
25foundation · easy
What is the primary purpose of auditing privileged access in an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.