Configuration Monitoring GMON Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A configuration monitoring tool is generating alerts for a server, but the alerts are inconsistent: sometimes the tool reports a change, and sometimes it does not, even though the configuration appears unchanged. The analyst suspects the tool is not reliable. What is the most likely cause?

   • AThe tool is monitoring the wrong configuration file.
   • BThe server has too many configuration files, overwhelming the tool.
   • CThe server's clock is not synchronized, causing timestamps to be incorrect.
   • DThe tool's baseline is outdated or the monitoring interval is too long, causing it to miss changes that occur between scans.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is deploying a new type of application server and needs to establish a secure configuration baseline. The team wants the baseline to be consistent across all servers and to serve as a reference for future compliance checks. Which approach is most appropriate?

   • ACreate a baseline based on the most common settings found on existing servers.
   • BHarden one server manually, document the settings, and use that as the baseline for all others.
   • CUse the default vendor configuration as the baseline.
   • DSkip the baseline and rely on real-time monitoring to detect issues.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A compliance report shows that several servers are missing a required security patch. The security team wants to remediate the issue and track the progress. What is the most effective next step?

   • ACreate a remediation ticket for each affected server and assign it to the appropriate system owner.
   • BImmediately apply the patch to all affected servers without testing.
   • CUpdate the compliance report to show the servers as compliant.
   • DWait for the next scheduled maintenance window and hope the issue resolves itself.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) wants to ensure that configuration monitoring alerts are not handled in isolation but are combined with other security data to provide context. Which integration is most effective?

   • AStore configuration alerts in a separate database and review them only when a security incident occurs.
   • BSend configuration alerts directly to the system administrator's email without any correlation.
   • CFeed configuration monitoring alerts into the SIEM and correlate them with vulnerability scan results and threat intelligence.
   • DPrint configuration alerts and post them on a physical security dashboard.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is deploying a new application that requires a specific configuration that deviates from the company's standard secure baseline. The deviation is necessary for the application to function, but the security team wants to ensure that the deviation is monitored and does not introduce unacceptable risk. What is the best approach?

   • ADocument the deviation as an approved exception, update the baseline for that application, and configure monitoring to alert on any further changes.
   • BDisable configuration monitoring for the application server to avoid alerts.
   • CForce the application to use the standard baseline even though it will not function correctly.
   • DUse the standard baseline but ignore any alerts related to the application.
   Reveal Solution Discussion Select an answer first