How does a vulnerability scanner typically identify missing patches on a system?

By checking the system's uptime to determine if it has been rebooted recently

By comparing the system's installed software versions and patch levels against a database of known vulnerabilities

By reviewing the system's firewall rules for misconfigurations

By analyzing network traffic for exploit attempts

How can evolving threats influence the patch and baseline process?

By requiring all patches to be applied immediately without testing

By making baseline configurations less important

By prompting adjustments to patch prioritization and baseline settings to address new risks

By eliminating the need for regular patching

A security team manages a diverse environment: a public-facing web application, an internal database with sensitive customer data, and a legacy system that cannot be patched. A new critical vulnerability is announced with an active exploit. The web application can be patched quickly, the database requires a lengthy change window, and the legacy system has no patch. Which approach best balances risk and operational constraints?

Apply compensating controls to all systems and defer all patching until the next change window.

Patch the legacy system by applying a workaround from the vendor.

Patch the database first because it contains sensitive data, and defer the web application.

Patch the web application immediately, schedule the database patch in the next window, and apply compensating controls to the legacy system.

Which factor is most important when determining the priority of a patch?

The number of patches released in the same month

The exploitability of the vulnerability the patch addresses

The vendor that released the patch

A company is deploying a new fleet of Linux servers. The security team wants to ensure each server starts with a consistent, hardened configuration and that any drift is detected and reported. Which combination of actions best achieves this goal?

Manually configure each server during deployment and rely on the system administrator to report any changes they make later.

Create a secure baseline configuration document, deploy it with Ansible, and schedule regular compliance scans that compare live systems to the baseline and report deviations.

Create a baseline document and store it in a shared drive, but do not enforce it because the servers are new.

Use a configuration management tool only during initial deployment, then disable it to avoid unintended changes.

GIAC Continuous Monitoring Certification

Domain 4Objective 3

Patching & Secure Baseline Configurations GMON Practice Questions (Page 10)

Part of the Configuration and Vulnerability Management domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 46–50

46foundation · easy
How does a vulnerability scanner typically identify missing patches on a system?
Select an answer first
47foundation · easy
How can evolving threats influence the patch and baseline process?
Select an answer first
48expert · hard
A security team manages a diverse environment: a public-facing web application, an internal database with sensitive customer data, and a legacy system that cannot be patched. A new critical vulnerability is announced with an active exploit. The web application can be patched quickly, the database requires a lengthy change window, and the legacy system has no patch. Which approach best balances risk and operational constraints?
Select an answer first
49foundation · easy
Which factor is most important when determining the priority of a patch?
Select an answer first
50application · medium
A company is deploying a new fleet of Linux servers. The security team wants to ensure each server starts with a consistent, hardened configuration and that any drift is detected and reported. Which combination of actions best achieves this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.