Configuration Monitoring GMON Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A configuration monitoring tool reports that a server's firewall configuration has changed, but the change was not made by any administrator. The change is subtle: a single port was opened. The server is in a DMZ. What is the most likely explanation and what should the analyst do?

   • AThe change was probably made by a previous administrator and not documented; the analyst should update the baseline.
   • BThe change is a normal event caused by a software update; the analyst should close the alert.
   • CThe change may indicate a compromise or unauthorized activity; the analyst should treat it as a potential incident and investigate thoroughly.
   • DThe change is likely a false positive from the monitoring tool; the analyst should ignore it.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is reviewing configuration monitoring alerts and sees that a database server's configuration changed to allow remote access from a new IP range. The change occurred at the same time as a legitimate maintenance window. However, the new IP range is not in the approved list. What should the analyst do?

   • AAccept the change as legitimate because it occurred during the maintenance window.
   • BTreat the change as suspicious and investigate further, correlating with other logs and the change management system.
   • CRevert the change immediately to the previous configuration.
   • DUpdate the baseline to include the new IP range to prevent future alerts.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team wants to correlate configuration changes with user activity to detect potential insider threats. They have configuration monitoring data and authentication logs. What is the most effective way to achieve this correlation?

   • AManually compare configuration change reports with user login reports on a weekly basis.
   • BStore configuration changes in a separate database and only review them when an incident occurs.
   • CUse the configuration monitoring tool to track which user made each change, without correlating with other logs.
   • DIngest both configuration change events and authentication logs into a SIEM and create correlation rules that link changes to user sessions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team needs to assess whether its Windows servers comply with a new internal security policy that requires specific registry settings and service configurations. The team wants to generate a compliance score and identify specific non-compliant settings. Which tool or technique is most appropriate?

   • AEnable Windows Defender Firewall logging and analyze the logs for configuration changes.
   • BUse a configuration assessment tool that compares current settings against the policy and reports non-compliant items.
   • CRun a penetration test to identify exploitable misconfigurations.
   • DManually review each server's registry and services during a scheduled maintenance window.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security auditor requires evidence that all web servers are configured according to the organization's security baseline. The configuration monitoring tool can generate compliance reports. What should the security team do to satisfy the auditor's request?

   • AExplain that the servers were configured securely during deployment and no further evidence is needed.
   • BProvide a list of the security policies and baselines used for the servers.
   • CGenerate a compliance report from the configuration monitoring tool showing the configuration status of all web servers against the baseline.
   • DGive the auditor access to the configuration monitoring tool so they can check the servers themselves.
   Reveal Solution Discussion Select an answer first