Configuration Monitoring GMON Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of configuration monitoring reports?

   • ATo communicate configuration status and compliance to stakeholders
   • BTo automatically remediate all non-compliant configurations
   • CTo serve as a backup of system files
   • DTo replace the need for configuration baselines
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices that a server's configuration monitoring tool is reporting a high number of configuration changes, but most are false positives caused by routine application updates. The analyst wants to reduce noise while still detecting real unauthorized changes. What is the best approach?

   • ADisable configuration monitoring for that server to avoid the noise.
   • BIgnore the alerts and review them only during quarterly audits.
   • CIncrease the alert threshold so only a large number of changes triggers an alert.
   • DCreate a baseline that excludes known-good application update paths and whitelist those changes.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is integrating configuration monitoring with its vulnerability management process. The team wants to ensure that configuration issues that increase the risk of exploitation are prioritized. What is the most effective integration?

   • AKeep configuration monitoring and vulnerability management as separate processes and review them independently.
   • BOnly use configuration monitoring for compliance reporting and vulnerability management for patching.
   • CUse configuration monitoring results to override vulnerability scan results.
   • DCorrelate configuration monitoring findings with vulnerability scan results to identify configurations that are both non-compliant and associated with known vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A configuration monitoring tool has identified that a server is missing a critical security patch. The patch is available and the server can be patched during the next maintenance window. What should the security team do?

   • ASchedule the patch for the next maintenance window and track the remediation in the configuration monitoring tool.
   • BAdd the server to an exception list and ignore the finding.
   • CWait for the next audit to address the finding.
   • DApply the patch immediately, even if it causes downtime.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has a mix of cloud-native and on-premises systems. The security team wants to implement configuration monitoring that covers both environments, but the cloud environment uses ephemeral instances that are frequently created and destroyed. Which approach best ensures continuous coverage?

   • AUse only a network-based scanner that periodically scans both environments.
   • BUse a single agent-based tool for all systems, but require manual registration of each new cloud instance.
   • CUse a cloud-native configuration monitoring service for cloud instances and an agent-based tool for on-premises servers, integrating both into a central dashboard.
   • DUse only an agent-based tool that is installed on each instance at launch, but do not integrate with the cloud provider's API.
   Reveal Solution Discussion Select an answer first