A company is implementing a new access control policy. The security team wants to ensure that employees can only access the resources necessary for their job. Which practice is most aligned with the principle of least privilege?

Grant all employees the same level of access to simplify administration.

Provide access based on the user's job title rather than their current responsibilities.

Review and revoke user access rights on a regular schedule.

Allow users to request access to any resource at any time.

A company is implementing a new security policy. The policy requires that all access to sensitive data be logged and that any anomalous access be investigated. Which control is most directly related to this requirement?

Enable auditing on the systems that store sensitive data.

Require annual security awareness training for all employees.

Deploy a network intrusion prevention system (IPS).

Implement a data loss prevention (DLP) system.

A security architect is designing access controls for a cloud environment. The company has a policy that requires least privilege, but the development team wants to have broad access to quickly provision resources. The architect must balance security with operational efficiency. Which approach best satisfies both requirements?

Deny all access to the development team and require them to submit a ticket for every action.

Use a role with permissions that are just enough for the development team's common tasks, and require a separate approval process for elevated access.

Grant the development team read-only access and have the security team perform all changes.

Grant the development team full administrative access to the cloud environment to avoid delays.

GIAC Continuous Monitoring Certification

Domain 1Objective 1

Cyber Defense Principles GMON Practice Questions (Page 7)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

1concept

Questions 31–33

31application · medium
A company is implementing a new access control policy. The security team wants to ensure that employees can only access the resources necessary for their job. Which practice is most aligned with the principle of least privilege?
Select an answer first
32application · medium
A company is implementing a new security policy. The policy requires that all access to sensitive data be logged and that any anomalous access be investigated. Which control is most directly related to this requirement?
Select an answer first
33expert · hard
A security architect is designing access controls for a cloud environment. The company has a policy that requires least privilege, but the development team wants to have broad access to quickly provision resources. The architect must balance security with operational efficiency. Which approach best satisfies both requirements?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Cyber Defense Principles GMON Practice Questions (Page 7)

Questions 31–33

A company is implementing a new access control policy. The security team wants to ensure that employees can only access the resources necessary for their job. Which practice is most aligned with the principle of least privilege?

A company is implementing a new security policy. The policy requires that all access to sensitive data be logged and that any anomalous access be investigated. Which control is most directly related to this requirement?

Keep studying — Security Monitoring Foundations