When assessing the risk of an unpatched system, which factor is most directly considered?

The likelihood that the missing patch addresses a vulnerability that could be exploited

The physical location of the system

The number of users who have administrative access to the system

A security team is building a secure baseline for Windows workstations. They want to ensure that any new workstation automatically receives the baseline settings and that deviations are corrected. Which approach best meets this requirement?

Apply Group Policy settings and use a configuration management tool to enforce and remediate drift.

Use a vulnerability scanner to identify missing patches and apply them manually.

Deploy a security agent that only reports non-compliance without any remediation capability.

Manually configure each workstation during imaging and rely on users to report changes.

A vulnerability scan reveals that a server is missing a patch for a vulnerability that has a CVSS score of 9.8. The server is not internet-facing and is only accessible by a small group of administrators. The patch has been available for three months. What is the most appropriate next step?

Immediately patch the server because the CVSS score is critical.

Assess the actual exploitability and impact in this environment, then prioritize the patch based on that risk.

Ignore the finding because the server is internal and only accessible by administrators.

Wait for the next scheduled patch cycle without further analysis.

How does a secure baseline configuration help reduce vulnerabilities?

By automatically installing all available patches

By monitoring user activity for suspicious behavior

By ensuring systems are configured consistently with security best practices, reducing misconfigurations

By encrypting all data on the system

What is the role of a change advisory board (CAB) in the patching process?

To develop the patches for software vendors

To perform the actual installation of patches

To monitor network traffic for anomalies

To review and approve significant changes, including patch deployments

GIAC Continuous Monitoring Certification

Domain 4Objective 3

Patching & Secure Baseline Configurations GMON Practice Questions (Page 2)

Part of the Configuration and Vulnerability Management domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 6–10

6foundation · easy
When assessing the risk of an unpatched system, which factor is most directly considered?
Select an answer first
7application · medium
A security team is building a secure baseline for Windows workstations. They want to ensure that any new workstation automatically receives the baseline settings and that deviations are corrected. Which approach best meets this requirement?
Select an answer first
8application · medium
A vulnerability scan reveals that a server is missing a patch for a vulnerability that has a CVSS score of 9.8. The server is not internet-facing and is only accessible by a small group of administrators. The patch has been available for three months. What is the most appropriate next step?
Select an answer first
9foundation · easy
How does a secure baseline configuration help reduce vulnerabilities?
Select an answer first
10foundation · easy
What is the role of a change advisory board (CAB) in the patching process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.