A security analyst discovers that a group of laptops has a different host firewall configuration than the company standard. The change was not approved. What is the most appropriate immediate action?

Reimage all laptops immediately without investigation

Investigate the change, determine the cause, and restore the standard configuration

Update the security policy to match the new configuration

Ignore the change because the laptops are still functioning

A security auditor requires evidence that all endpoints comply with the company's security baseline. The company has a configuration management tool. What should the monitoring team provide?

A copy of the security policy document.

A report showing the current configuration of each endpoint compared to the baseline.

A list of all endpoints that have been patched in the last month.

A summary of alerts generated in the last quarter.

A network administrator is troubleshooting a user's complaint that their laptop is running slowly. The administrator wants to determine if the issue is caused by high memory usage or a specific process. Which monitoring data would be most useful?

Overall CPU usage averaged over the last hour

Per-process performance counters collected over time

An organization's compliance team requires that all servers have a specific security baseline applied. A monitoring tool reports that several servers have drifted from the baseline. What is the best way to handle this situation?

Document the drift and accept the risk

Disable the compliance monitoring for those servers

Manually change the baseline to match the current configuration

Automatically remediate the servers by reapplying the baseline configuration

A security manager is implementing configuration monitoring for a mixed environment of Windows and Linux servers. The team has limited staff and cannot manually review every configuration change. They need to prioritize alerts that indicate a potential security impact. Which approach is most effective?

Alert on all configuration changes equally

Review configuration changes weekly in a manual meeting

Only monitor Windows servers because they are more common

Use a configuration assessment tool that scores changes based on security impact and alerts on high-risk changes

GIAC Continuous Monitoring Certification

Domain 3Objective 2

Device Monitoring GMON Practice Questions (Page 9)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 41–45

41application · medium
A security analyst discovers that a group of laptops has a different host firewall configuration than the company standard. The change was not approved. What is the most appropriate immediate action?
Select an answer first
42application · medium
A security auditor requires evidence that all endpoints comply with the company's security baseline. The company has a configuration management tool. What should the monitoring team provide?
Select an answer first
43application · medium
A network administrator is troubleshooting a user's complaint that their laptop is running slowly. The administrator wants to determine if the issue is caused by high memory usage or a specific process. Which monitoring data would be most useful?
Select an answer first
44application · medium
An organization's compliance team requires that all servers have a specific security baseline applied. A monitoring tool reports that several servers have drifted from the baseline. What is the best way to handle this situation?
Select an answer first
45expert · hard
A security manager is implementing configuration monitoring for a mixed environment of Windows and Linux servers. The team has limited staff and cannot manually review every configuration change. They need to prioritize alerts that indicate a potential security impact. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.