Device Monitoring GMON Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the main goal of monitoring device health and performance metrics?

   • ATo track user web browsing history
   • BTo enforce password complexity requirements
   • CTo detect anomalies and ensure device reliability
   • DTo replace the need for antivirus software
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A large enterprise has 10,000 endpoints across multiple sites. They have a CMDB but it is known to be incomplete. The security team needs to ensure all devices are monitored for health and compliance. They have budget for one new tool. Which tool should they choose?

   • AAn endpoint detection and response (EDR) tool that requires an agent on every device.
   • BA network discovery tool that scans the entire IP space and integrates with the CMDB.
   • CA SIEM that can ingest logs from all devices.
   • DA configuration management tool that enforces baselines.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company has a SIEM but is experiencing high storage costs due to verbose logging. They need to retain logs for compliance but also want to reduce costs. What is the best strategy?

   • ADelete logs older than 30 days to save space.
   • BTier storage: keep hot logs in the SIEM for a short period and archive older logs to cheaper storage.
   • CRetain all logs in the SIEM for the required period and accept the cost.
   • DReduce log verbosity for all devices to lower storage usage.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A hospital network has 2,000+ endpoints including Windows workstations, Linux servers, and IoT infusion pumps. The security team needs to establish a baseline for monitoring device health and log collection. They have no existing inventory. What is the first step they should take?

   • ARun an active network discovery scan and correlate results with DHCP and DNS records to build a device inventory.
   • BDeploy a log collector to all subnets and begin ingesting syslog and Windows Event logs.
   • CConfigure performance alerts on the existing SIEM for CPU and memory thresholds.
   • DAsk each department to email a list of their devices to the security team.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A database server is experiencing high CPU usage during peak hours. The monitoring team wants to distinguish between normal peak usage and a potential issue. What should they do?

   • AMonitor only memory usage instead of CPU.
   • BSet a static threshold of 80% CPU and alert whenever it is exceeded.
   • CIncrease the server's CPU capacity to avoid reaching high usage.
   • DAnalyze historical CPU usage patterns to define a baseline for peak hours.
   Reveal Solution Discussion Select an answer first