Device Monitoring GMON Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A server has been compromised. The monitoring team needs to determine the impact and scope. They have performance monitoring data and configuration baselines. What is the most useful information for the investigation?

   • APerformance data showing CPU and memory spikes during the compromise.
   • BThe number of active user sessions.
   • CConfiguration changes from the baseline that occurred around the time of the compromise.
   • DThe current uptime of the server.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A monitoring team has configured alerts for multiple device metrics. They are experiencing alert fatigue, with many false positives. They need to improve alert effectiveness without missing real issues. What is the best approach?

   • AAssign all alerts to a single analyst for consistency.
   • BDisable alerts for less critical metrics.
   • CIncrease all alert thresholds to reduce the number of alerts.
   • DUse correlation rules to group related alerts and suppress duplicates.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a mix of legacy and modern servers. The monitoring team wants to detect performance anomalies but has limited resources. They have historical data for all servers. What is the most efficient approach?

   • AMonitor only the modern servers because they are more critical.
   • BCreate individual baselines for each server based on its historical data.
   • CUse static thresholds based on industry standards for all servers.
   • DApply a single baseline model to all servers to simplify management.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's file server has been experiencing intermittent slowdowns. The monitoring team wants to detect anomalies early. They have historical performance data. Which approach is most effective?

   • AIncrease alerting frequency to every minute for all metrics.
   • BSet static thresholds for CPU, memory, disk, and network usage based on vendor recommendations.
   • CUse historical performance data to establish a baseline and alert on deviations from normal patterns.
   • DMonitor only CPU usage because it is the most common cause of slowdowns.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team needs to ensure that all endpoints comply with a new security baseline. They have a configuration management tool but it only covers 80% of devices. The remaining 20% are unmanaged. What is the best approach to achieve compliance?

   • AUse network access control to block non-compliant devices.
   • BDeploy the configuration management agent to the unmanaged devices and enforce the baseline.
   • CCreate a manual checklist for the unmanaged devices.
   • DAccept the 80% coverage and document the risk.
   Reveal Solution Discussion Select an answer first