Configuration Monitoring GMON Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst discovers that several servers have a configuration setting that violates the organization's security policy. The analyst has verified that the setting is not required for any business function. What is the most appropriate action for the analyst to take?

   • AReport the finding to management and let them decide what to do.
   • BWait for the next scheduled maintenance window and change the setting then.
   • CChange the setting on the affected servers to comply with the policy and document the change.
   • DAdd the setting to the exception list in the monitoring tool to suppress future alerts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which activity is an example of configuration monitoring?

   • AInstalling the latest operating system patches
   • BReviewing firewall logs for denied connection attempts
   • CComparing current system settings against an approved baseline
   • DRunning a penetration test against a web application
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A configuration monitoring tool reports that a server's registry key has changed from the baseline. The change occurred at 2:00 AM and the server is a domain controller. The analyst sees that the new value matches a known-good configuration from a recent patch. What should the analyst do?

   • AIgnore the alert because the change occurred during off-hours.
   • BEscalate the alert to the incident response team as a potential compromise.
   • CVerify that the change is legitimate by checking the patch deployment logs and then update the baseline if appropriate.
   • DImmediately revert the registry key to the previous value to restore the baseline.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which technique is commonly used to detect configuration changes?

   • APerforming annual penetration tests
   • BReviewing user access reviews on a quarterly basis
   • CAnalyzing network traffic for malicious payloads
   • DHashing critical configuration files and comparing hashes periodically
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A configuration monitoring report shows that 30% of servers are non-compliant with the organization's password policy. The non-compliant servers are in a legacy application environment that cannot be easily changed without causing downtime. The security team must reduce the risk while maintaining business operations. What is the best approach?

   • ARemove the non-compliant servers from the compliance report to show a better score.
   • BApply compensating controls, such as stricter access restrictions and enhanced logging, while documenting the exception and planning a phased remediation.
   • CDisable the password policy check in the monitoring tool for those servers.
   • DForce the password policy change immediately on all servers, accepting potential downtime.
   Reveal Solution Discussion Select an answer first