Patching & Secure Baseline Configurations GMON Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security manager needs to provide a monthly report to the executive team about the organization's patching status. The report must show the percentage of systems that are fully patched, the number of exceptions, and the trend over time. Which data source and reporting approach best satisfies this requirement?

   • AUse the patch management tool's deployment log to show only the number of patches deployed, without tracking exceptions.
   • BAsk each system administrator to manually report the patch status of their systems each month.
   • CCreate a report from the change management system that lists all approved changes.
   • DUse the vulnerability scanner's compliance dashboard to generate a report that includes patch compliance percentages, exception counts, and historical trends.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team wants to ensure that all new servers are configured with a secure baseline before they are placed into production. What is the best way to achieve this?

   • ARun a vulnerability scan after deployment and fix any issues.
   • BManually configure each server after it is deployed.
   • CUse a configuration management tool to apply the baseline during provisioning.
   • DProvide a checklist to the server administrators.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A compliance officer asks for a report showing which systems are not compliant with the patching policy and what exceptions have been granted. What is the best way to provide this information?

   • AGenerate a report from the vulnerability management and exception tracking systems.
   • BProvide only the list of approved exceptions.
   • CManually compile the information from emails and spreadsheets.
   • DProvide only the list of systems that are missing patches.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company uses Ansible to manage its Linux servers. A recent audit found that several servers have drifted from the secure baseline because some administrators manually changed settings. The security team wants to enforce the baseline automatically while allowing legitimate temporary changes for troubleshooting. Which approach best balances enforcement and operational flexibility?

   • ARun Ansible in check mode only and generate reports for manual review.
   • BDisable Ansible entirely to avoid interfering with manual changes.
   • CRun Ansible in enforcing mode on a schedule to revert any drift, and require that temporary changes be made through a documented exception process that disables enforcement for a limited time.
   • DAllow administrators to make changes freely and rely on the audit to catch issues later.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Linux administrator manages 200 servers with Ansible. They need to enforce a secure baseline that includes specific SSH settings and file permissions. What is the most efficient way to ensure all servers remain compliant?

   • AWrite a shell script and run it manually on each server once.
   • BUse a vulnerability scanner to detect non-compliant SSH settings.
   • CDocument the baseline in a wiki and ask administrators to follow it.
   • DCreate an Ansible playbook that applies the baseline and schedule it to run regularly.
   Reveal Solution Discussion Select an answer first