Device Monitoring GMON Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC is designing alert rules for a fleet of laptops. The team wants to detect a possible ransomware attack, which often involves rapid file changes and high disk activity. However, some users run legitimate applications that also cause high disk activity. How should the SOC configure alerts to reduce false positives while still detecting ransomware?

   • ADisable disk activity alerts and rely on user reports
   • BCorrelate high disk activity with other indicators, such as file encryption extensions or known ransomware processes
   • CSet a very high threshold for disk activity to avoid false positives
   • DAlert on any endpoint with high disk activity
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is required to retain security logs for one year. They have a SIEM with limited storage. They also need to be able to quickly search recent logs for incident response. What is the best approach?

   • AStore all logs in the SIEM for one year and increase storage capacity.
   • BOnly retain logs for critical servers.
   • CCompress logs and store them on the endpoints themselves.
   • DKeep logs in the SIEM for 90 days and archive older logs to low-cost storage with a retrieval process.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is preparing for an audit and needs to produce a list of all devices that have accessed the corporate network in the last 90 days. The company uses DHCP and has no formal asset management system. Which data source would provide the most complete evidence?

   • AActive Directory computer accounts
   • BFirewall logs showing only blocked traffic
   • CA manually maintained spreadsheet from the IT helpdesk
   • DDHCP server logs showing IP address leases
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the main benefit of centralizing device logs and events?

   • AIt reduces the storage required for logs
   • BIt enables analysis and correlation across multiple devices
   • CIt eliminates the need for endpoint protection software
   • DIt automatically patches all devices
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations center (SOC) needs to correlate security events from thousands of endpoints with network and application logs. Currently, endpoint logs are stored locally on each device. What is the first step to enable centralized analysis?

   • AIncrease local log storage capacity on each endpoint
   • BEnable Windows Event Log on all endpoints
   • CAsk administrators to manually copy logs to a shared drive weekly
   • DConfigure a central log management platform and deploy agents to forward endpoint logs to it
   Reveal Solution Discussion Select an answer first