Device Monitoring GMON Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   Which action is part of incident response after a device monitoring alert is triggered?

   • ADeleting all logs to prevent data overload
   • BInvestigating the alert to determine if it indicates a real threat
   • CIgnoring the alert if it occurs during off-hours
   • DRebooting the device immediately without analysis
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security analyst needs to investigate a potential malware infection on a workstation. The company centralizes logs in a SIEM. What is the most efficient way to begin the investigation?

   • ARun a full antivirus scan on the workstation.
   • BCheck the firewall logs for outbound connections.
   • CRequest the workstation's local event logs from the user.
   • DSearch the SIEM for all logs from the workstation in the relevant time window.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary purpose of device configuration and compliance monitoring?

   • ATo verify device configurations align with security policies and detect unauthorized changes
   • BTo measure network bandwidth utilization
   • CTo collect and centralize event logs
   • DTo automate software deployment
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A monitoring analyst notices that a database server's disk usage has been growing steadily over the past week. The server is critical and has no spare capacity. What should the analyst do first?

   • ACreate an alert for disk usage at 85% and wait for it to trigger
   • BIncrease the disk space by adding a new virtual disk
   • CInvestigate the cause of the disk growth, such as log files or database growth, and take corrective action
   • DReboot the server to clear temporary files
   Reveal Solution Discussion Select an answer first