A security team is setting up centralized logging for endpoints. They want to ensure that logs are not lost if the central log server is unavailable. Which configuration should they use?

Send logs directly to the central server without buffering

Configure agents to buffer logs locally and forward them when the server is reachable

Use UDP to send logs to the central server

Store logs only on the endpoint and never forward them

A security analyst discovers that a laptop's firewall was disabled and an unauthorized application was installed. The company has a configuration management database (CMDB) and a security baseline. What should the analyst do to detect such changes in the future?

Block all software installations using application whitelisting.

Increase the frequency of vulnerability scans.

Compare the laptop's current configuration against the CMDB baseline and alert on any differences.

Review the laptop's event logs for the time of the incident.

Which activity is most directly associated with device inventory and asset management?

Reviewing firewall logs for blocked traffic

Enumerating all endpoints connected to the network

Analyzing CPU usage trends on a server

Configuring an alert for failed login attempts

Which of the following is an example of a configuration change that compliance monitoring would flag?

A user logging in from a new location

CPU usage exceeding 90% for five minutes

A disk filling up to 95% capacity

A firewall rule being added without approval

A large organization is merging with another company and needs to integrate the device inventories of both entities. The two companies use different asset management tools and have overlapping IP address ranges. What is the most important first step to create a unified device inventory?

Manually review and combine the two spreadsheets

Merge the two databases by IP address

Use the hostname as the primary key for merging

Establish a unique device identifier, such as a hardware ID or serial number, for each device

GIAC Continuous Monitoring Certification

Domain 3Objective 2

Device Monitoring GMON Practice Questions (Page 2)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 6–10

6application · medium
A security team is setting up centralized logging for endpoints. They want to ensure that logs are not lost if the central log server is unavailable. Which configuration should they use?
Select an answer first
7application · medium
A security analyst discovers that a laptop's firewall was disabled and an unauthorized application was installed. The company has a configuration management database (CMDB) and a security baseline. What should the analyst do to detect such changes in the future?
Select an answer first
8foundation · easy
Which activity is most directly associated with device inventory and asset management?
Select an answer first
9foundation · easy
Which of the following is an example of a configuration change that compliance monitoring would flag?
Select an answer first
10expert · hard
A large organization is merging with another company and needs to integrate the device inventories of both entities. The two companies use different asset management tools and have overlapping IP address ranges. What is the most important first step to create a unified device inventory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.