Configuration Monitoring GMON Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small business has a single IT administrator who manages a few servers. The administrator wants to implement configuration monitoring but has limited time and budget. What is the most practical approach for this environment?

   • ARely on the operating system's built-in security features to prevent configuration changes.
   • BImplement a full enterprise configuration management suite with automated remediation.
   • CManually check configurations on a monthly basis using a checklist.
   • DUse a lightweight open-source configuration monitoring tool that checks critical settings against a baseline and sends email alerts.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is investigating a potential security incident and needs to determine whether an attacker modified a system's configuration. The analyst has access to the configuration monitoring tool's logs. What is the most useful information to look for?

   • AThe version of the configuration monitoring tool.
   • BThe timestamp, user account, and the specific configuration change that was made.
   • CThe IP address of the system that reported the change.
   • DThe total number of changes made in the last month.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is analyzing configuration monitoring data and notices that a server's configuration has been changed to disable a security control. The change was made by a legitimate administrator account, but the analyst suspects the account may have been compromised. What is the best next step?

   • AIgnore the change because it was made by a legitimate administrator account.
   • BAsk the administrator if they made the change, and if they say yes, close the investigation.
   • CImmediately disable the administrator account and revert the change.
   • DCorrelate the configuration change with other security events, such as unusual login times or lateral movement, to determine if the account is compromised.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is setting up configuration monitoring for a fleet of Linux web servers. The team has already documented a secure baseline for the servers. The analyst needs to detect any unauthorized change to the /etc/passwd file and receive an alert within 15 minutes. Which approach best meets the requirement?

   • ADeploy a file integrity monitoring agent that hashes /etc/passwd on a schedule and compares the hash to the baseline, alerting on mismatch.
   • BSet the /etc/passwd file to read-only using chattr +i and rely on the OS to prevent changes.
   • CConfigure the system's syslog to forward all authentication logs to the SIEM for review.
   • DRun a weekly manual audit of the /etc/passwd file against the documented baseline using a checklist.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A configuration monitoring tool reports that a server's firewall rule was changed at 3:00 AM. The change was not approved. The analyst wants to determine if this change is related to a recent malware infection. What is the best next step?

   • ARevert the firewall change immediately and ignore the incident.
   • BContact the server administrator and ask if they made the change.
   • CCheck the server's uptime to see if it was rebooted.
   • DCorrelate the firewall change with other security events, such as malware alerts and network connections from the server.
   Reveal Solution Discussion Select an answer first