Configuration Monitoring GMON Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team is required to assess its servers against the CIS Benchmarks. The team wants to automate this assessment and generate a report that can be shared with auditors. Which tool is best suited for this task?

   • AA network intrusion detection system (NIDS) that monitors traffic.
   • BA log management tool that collects system logs.
   • CA configuration assessment tool that supports CIS Benchmarks and can export reports.
   • DA vulnerability scanner that checks for known CVEs.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company uses a mix of on-premises servers and cloud VMs. The security team wants to automate configuration monitoring across both environments and integrate alerts into their existing SIEM. Which solution is the best fit?

   • AUse a network scanner to periodically scan all servers for open ports and services.
   • BUse only the cloud provider's native configuration monitoring service for cloud VMs and ignore on-premises servers.
   • CRun manual configuration checks on each server and document the results in a spreadsheet.
   • DDeploy an agent-based configuration monitoring tool on all servers and forward alerts to the SIEM.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which standard is commonly used as a benchmark for secure configuration compliance?

   • APCI DSS
   • BCIS Benchmarks
   • CISO 27001
   • DOWASP Top 10
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst at a mid-sized company is tasked with detecting unauthorized changes to the configuration of 200 Linux web servers. The servers are managed by a central configuration management tool, and the team wants to identify changes that occur outside of approved change windows. Which approach best meets the requirement?

   • AReview system logs daily for authentication events and user activity.
   • BCompare the current configuration to the baseline only during annual audits.
   • CEnable file integrity monitoring on critical configuration files and correlate alerts with the change-management system.
   • DRun a weekly vulnerability scanner against the servers and review the report for configuration issues.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization must ensure that all Windows servers meet the CIS benchmark for Windows Server 2019. The security team has deployed a configuration assessment tool that checks each server against the benchmark. The tool reports that several servers are non-compliant for the 'Password Policy' settings. What should the team do next to address the non-compliance?

   • AReview the specific settings that failed, determine if they are applicable to the server's role, and apply remediation via Group Policy if appropriate.
   • BExport the compliance report and send it to management without taking any further action.
   • CImmediately apply the CIS-recommended settings to all servers using a script, regardless of the server's role.
   • DDisable the password policy checks in the assessment tool to reduce the number of reported non-compliant items.
   Reveal Solution Discussion Select an answer first