What is the purpose of configuring alerts based on device monitoring thresholds?

To reduce the amount of log data collected

To automatically block all network traffic

To replace the need for incident response procedures

To notify security personnel when a metric exceeds a predefined level

A server that runs a critical batch job every night has been experiencing intermittent slowdowns. The monitoring team wants to detect the issue early without generating excessive alerts. What is the most effective approach?

Increase the polling interval to every 30 minutes to reduce noise

Set a static threshold of 90% CPU usage and alert when exceeded for 5 minutes

Alert only when the server becomes unresponsive to ping

Use baseline-based alerting that compares current CPU and memory usage to historical patterns for that time of day

A monitoring team is troubleshooting a server that periodically becomes unresponsive. The server's CPU and memory metrics look normal, but the issue occurs only during peak business hours. Which additional monitoring data would be most useful to identify the root cause?

Disk I/O latency and queue length

A SOC analyst is investigating a potential malware infection on an endpoint. The analyst needs to see what processes ran, what files were created, and what network connections were made around the time of infection. Which log source is most likely to provide this information?

Endpoint detection and response (EDR) telemetry

A monitoring team receives an alert that a server's configuration has changed. The change was not authorized. What is the first action they should take?

Disable the server from the network to contain the change.

Verify the alert and assess the impact before taking action.

Revert the configuration to the known-good baseline immediately.

Ignore the alert if the server is still functioning.

GIAC Continuous Monitoring Certification

Domain 3Objective 2

Device Monitoring GMON Practice Questions (Page 6)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 26–30

26foundation · easy
What is the purpose of configuring alerts based on device monitoring thresholds?
Select an answer first
27application · medium
A server that runs a critical batch job every night has been experiencing intermittent slowdowns. The monitoring team wants to detect the issue early without generating excessive alerts. What is the most effective approach?
Select an answer first
28expert · hard
A monitoring team is troubleshooting a server that periodically becomes unresponsive. The server's CPU and memory metrics look normal, but the issue occurs only during peak business hours. Which additional monitoring data would be most useful to identify the root cause?
Select an answer first
29application · medium
A SOC analyst is investigating a potential malware infection on an endpoint. The analyst needs to see what processes ran, what files were created, and what network connections were made around the time of infection. Which log source is most likely to provide this information?
Select an answer first
30application · medium
A monitoring team receives an alert that a server's configuration has changed. The change was not authorized. What is the first action they should take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.