A hospital has a medical device running an outdated operating system that cannot be patched because the vendor has not validated any patch. The device is critical for patient care and cannot be taken offline. The security team must manage this risk while maintaining compliance reporting. Which approach best balances patient safety, security, and compliance?

Force the vendor to provide a patch by threatening to replace the device, and if no patch is available, disconnect the device from the network.

Document a formal exception with a risk assessment, implement compensating controls such as network segmentation and strict access controls, and include the device in compliance reports as an exception.

Apply the patch anyway because the vulnerability is critical, even though the vendor has not validated it.

Hide the device from compliance reports so the organization appears fully compliant.

A security team reviews the metrics from the past quarter and finds that the mean time to patch (MTTP) for critical vulnerabilities is 14 days, but the goal is 7 days. The team also notices that the patching window is only available on weekends, and some patches require multiple reboots. Which improvement is most likely to reduce MTTP?

Require manual approval for every patch to ensure quality.

Increase the frequency of patching windows to include weekdays and use automation to handle multi-reboot patches.

Change the goal to 14 days to match the current performance.

Reduce the number of vulnerability scans to avoid alert fatigue.

A patch management team wants to reduce the time spent on change requests for routine monthly patches while still ensuring that changes are reviewed and approved. Which approach best achieves this?

Create a standard change template for routine patches that pre-approves the change if it meets defined criteria.

Skip the change management process for all patches because they are routine.

Submit a separate change request for every server and patch.

Have the patch team approve their own changes without review.

A compliance officer asks for a report that shows which systems are not compliant with the patching policy and the reason for each exception. The report must be generated automatically every week. Which approach best fulfills this request?

Manually compile the list from emails sent by system administrators.

Create a static report once and reuse it every week.

Configure the patch management tool to export a compliance report that includes exception reasons and schedule it to run weekly.

Use the vulnerability scanner to list all missing patches, but do not include exception reasons.

How does automation improve baseline enforcement?

By manually reviewing each system's configuration

By disabling security settings to improve performance

By automatically applying configuration settings to systems and correcting drift

By allowing users to choose their own settings

GIAC Continuous Monitoring Certification

Domain 4Objective 3

Patching & Secure Baseline Configurations GMON Practice Questions (Page 6)

Part of the Configuration and Vulnerability Management domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 26–30

26expert · hard
A hospital has a medical device running an outdated operating system that cannot be patched because the vendor has not validated any patch. The device is critical for patient care and cannot be taken offline. The security team must manage this risk while maintaining compliance reporting. Which approach best balances patient safety, security, and compliance?
Select an answer first
27expert · hard
A security team reviews the metrics from the past quarter and finds that the mean time to patch (MTTP) for critical vulnerabilities is 14 days, but the goal is 7 days. The team also notices that the patching window is only available on weekends, and some patches require multiple reboots. Which improvement is most likely to reduce MTTP?
Select an answer first
28application · medium
A patch management team wants to reduce the time spent on change requests for routine monthly patches while still ensuring that changes are reviewed and approved. Which approach best achieves this?
Select an answer first
29application · medium
A compliance officer asks for a report that shows which systems are not compliant with the patching policy and the reason for each exception. The report must be generated automatically every week. Which approach best fulfills this request?
Select an answer first
30foundation · easy
How does automation improve baseline enforcement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Patching & Secure Baseline Configurations GMON Practice Questions (Page 6)

Questions 26–30

A patch management team wants to reduce the time spent on change requests for routine monthly patches while still ensuring that changes are reviewed and approved. Which approach best achieves this?

A compliance officer asks for a report that shows which systems are not compliant with the patching policy and the reason for each exception. The report must be generated automatically every week. Which approach best fulfills this request?

How does automation improve baseline enforcement?

Keep studying — Configuration and Vulnerability Management