Device Monitoring GMON Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of maintaining a device inventory in an organization's endpoint monitoring program?

   • ATo automatically patch all endpoints without manual intervention
   • BTo replace the need for real-time monitoring tools
   • CTo establish a baseline of all endpoint devices that need to be monitored
   • DTo enforce network segmentation policies on all devices
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which activity is part of device logging and event collection?

   • AEnumerating all devices on the network
   • BComparing device configurations to a baseline
   • CForwarding syslog messages from network devices to a central server
   • DSetting a threshold for CPU usage alerts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to centralize logs from all endpoints to a SIEM for security analysis. They have Windows, Linux, and network devices. What is the most important consideration for effective log collection?

   • AEnsure all devices have synchronized time using NTP.
   • BUse a proprietary log format for each device type.
   • CCollect logs only from critical servers to reduce storage costs.
   • DStore logs locally on each device for 90 days.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a large number of IoT devices that are not managed by the standard configuration management tool. The security team needs to ensure these devices are compliant with security policies. What is the best approach?

   • AManually check each IoT device's configuration on a regular basis.
   • BForce the IoT devices to be managed by the existing configuration management tool.
   • CUse a specialized IoT security platform that can inventory and monitor these devices.
   • DExclude IoT devices from compliance monitoring because they are not critical.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has a security policy that requires all endpoints to have full-disk encryption enabled and the host firewall active. The security team needs to verify compliance continuously and be alerted when a device drifts from the policy. What should they implement?

   • AA one-time audit report generated by the IT team
   • BA configuration assessment tool that checks endpoints against the policy and feeds results to the alerting system
   • CA helpdesk process that manually reviews each device during support calls
   • DA network scanner that checks for open ports on each endpoint
   Reveal Solution Discussion Select an answer first