Cyber Defense Principles GMON Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is implementing a monitoring solution for a multi-tenant environment. The team wants to ensure that a compromise in one tenant does not affect the monitoring of other tenants. Which approach best supports this goal?

   • AUse a single monitoring account for all tenants to simplify management.
   • BStore logs for each tenant in the same storage bucket but rely on encryption.
   • CUse separate monitoring accounts for each tenant and aggregate logs into a central SIEM with strict access controls.
   • DDo not aggregate logs centrally; have each tenant monitor its own environment independently.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is implementing a new access control system. The team wants to ensure that users have the minimum access necessary, but the system must also be usable. Which approach best balances least privilege and usability?

   • AGrant all users full access to the system to ensure they can perform any task.
   • BUse a single administrative account for all users to simplify management.
   • CImplement role-based access control (RBAC) with roles that align to job functions.
   • DRequire users to request access to each resource individually, with no pre-defined roles.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is configuring a new SIEM. The company wants to ensure that the SIEM can detect a variety of attacks, including those that use legitimate administrative tools. Which monitoring approach best supports this goal?

   • AEnable logging only for administrative accounts, because they are the most likely to be compromised.
   • BCollect logs from endpoints, network devices, and applications, and correlate them to identify suspicious behavior.
   • CCollect only firewall logs, because they contain all relevant network traffic.
   • DUse a signature-based IDS and rely on known attack patterns.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security architect is designing a monitoring solution for a company that operates in multiple countries. The company must comply with data residency requirements that prohibit certain data from leaving a specific country. The architect wants to centralize monitoring in a single SOC. Which approach best balances compliance and monitoring efficiency?

   • AForward all logs to the central SOC and rely on encryption to protect the data in transit.
   • BDeploy local log collectors in each country and forward only metadata to the central SOC.
   • CUse a cloud-based SIEM that is hosted in a single country and hope that the data residency requirements are not enforced.
   • DStore logs only in the country where they are generated and do not provide any central visibility.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is implementing a new security policy. The policy requires that all employees use multi-factor authentication (MFA) for remote access, but the IT department is concerned about the impact on productivity. Which approach best balances security and usability?

   • ADelay MFA implementation until a less intrusive technology is available.
   • BSkip MFA for employees who find it inconvenient and rely on strong passwords.
   • CImplement MFA only for executives and leave other employees with passwords only.
   • DImplement MFA for all remote access and provide training and support to help employees adapt.
   Reveal Solution Discussion Select an answer first