Configuration Monitoring GMON Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which type of analysis is most useful for detecting configuration anomalies?

   • AComparing current configurations to historical baselines
   • BReviewing employee performance metrics
   • CCounting the number of help desk tickets
   • DAnalyzing network traffic for malware signatures
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security analyst is reviewing configuration monitoring data and notices that a server's configuration has changed multiple times over the past week, but each change was individually approved. However, the cumulative effect of the changes has made the server non-compliant with a security policy. What should the analyst do?

   • AIgnore the issue because all changes were approved.
   • BFlag the cumulative non-compliance and work with the system owner to revert or adjust the changes to restore compliance.
   • CUpdate the security policy to match the new configuration.
   • DAutomatically revert all changes to the original baseline without consulting the system owner.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A configuration monitoring tool is generating a high number of alerts for a group of servers. The analyst notices that many alerts are for the same configuration item that changes frequently due to a legitimate application process. What should the analyst do to reduce noise while maintaining visibility?

   • AIncrease the alert threshold so that only changes occurring more than once a day trigger an alert.
   • BIgnore the alerts because they are expected and not a security risk.
   • CCreate a whitelist or exception for that specific configuration item on those servers, with a documented reason.
   • DDisable configuration monitoring for those servers entirely.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security operations team wants to automate the detection of configuration drift on a set of network devices. They currently use a configuration management tool that can store the intended configuration for each device. Which feature of the tool should they enable to meet this goal?

   • AConfiguration backup and comparison against the stored baseline with alerting on differences.
   • BSyslog forwarding of device logs to a central log server.
   • CPeriodic manual review of device configurations by network engineers.
   • DSNMP trap generation for interface status changes.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   An organization must comply with a regulation that requires configuration monitoring for all systems handling cardholder data. The compliance team wants to ensure that the configuration monitoring tool is properly configured to meet the regulation. What is the most important consideration?

   • AThe tool must generate a monthly report for management.
   • BThe tool must monitor all in-scope systems and provide evidence that configuration changes are detected and reviewed.
   • CThe tool must be able to automatically remediate any non-compliant configuration.
   • DThe tool must be installed on every system, including those not in scope.
   Reveal Solution Discussion Select an answer first