Device Monitoring GMON Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team has implemented device monitoring but is overwhelmed by alerts. They want to prioritize alerts based on risk. What is the most effective way to do this?

   • ARandomly assign alerts to analysts.
   • BAssign a severity level to each alert based on the affected device's criticality.
   • COnly alert on alerts that have been confirmed by multiple sources.
   • DHandle alerts in the order they are received.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SOC is configuring alerts for a fleet of servers. The team wants to detect a potential cryptocurrency miner, which typically causes sustained high CPU usage, but they also have a legitimate batch processing workload that causes high CPU usage at night. How should they design the alert to minimize false positives while still detecting the miner?

   • AAlert on any server with CPU usage above 90% for 15 minutes
   • BSet a single global threshold of 95% CPU for all servers
   • CDisable CPU alerts and rely on network traffic analysis to detect miners
   • DCreate separate baselines for day and night and alert on deviations from the expected pattern
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has a mix of managed and unmanaged devices on its network. The security team wants to ensure all devices are monitored and compliant. What is the best approach?

   • ADisable network access for any device without an installed agent.
   • BUse network access control (NAC) to enforce that only compliant devices can access the network.
   • CDeploy an agent to all managed devices and use passive network monitoring to detect unmanaged devices.
   • DRely on the CMDB to track all devices, assuming it is up to date.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is centralizing endpoint logs for security monitoring, but the log volume is overwhelming the storage system and budget. The security team needs to retain logs for compliance but cannot afford unlimited storage. Which strategy best balances cost and security visibility?

   • AUse tiered storage: keep detailed logs for a short period and summarized logs for longer retention
   • BCollect logs only from critical servers
   • CStore all logs at full detail for the required compliance period
   • DDelete logs older than 30 days
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization's monitoring system generates a high volume of alerts from endpoint performance metrics, but the security team is overwhelmed and missing critical incidents. Which strategy would most effectively reduce alert fatigue while maintaining visibility?

   • ARoute all alerts to a single analyst for manual triage
   • BDisable all performance-related alerts and focus only on security events
   • CImplement alert aggregation and correlation rules to group related alerts into incidents
   • DIncrease the alert threshold for all metrics to the highest possible value
   Reveal Solution Discussion Select an answer first