What is a secure baseline configuration?

A network diagram showing all system connections

A list of approved software vendors for the organization

A documented set of minimum security settings and configurations that systems must meet

A backup of the system's registry and configuration files

What is the primary purpose of configuration management tools like Ansible or Group Policy?

To provide a user interface for system administration

To enforce consistent and secure configurations across many systems

To replace the need for antivirus software

To monitor network traffic for intrusions

A vulnerability scan identifies a missing patch on a server that is part of a PCI-DSS compliant environment. The patch is rated medium severity and has no known exploit. The compliance team requires all medium vulnerabilities to be remediated within 30 days. What is the best action?

Apply the patch immediately because it is in a PCI environment.

Request an exception because the vulnerability is medium severity.

Apply the patch within the 30-day compliance window.

Ignore the finding because there is no known exploit.

What is a key input for continuously improving the patch management process?

The number of employees in the IT department

The number of patches released by vendors each month

The cost of the patch management software

Metrics on patch compliance and the number of incidents related to unpatched vulnerabilities

A company uses Ansible to manage its Linux servers. The security team wants to ensure that all servers have the same secure baseline configuration and that any changes are automatically reverted. Which Ansible approach best achieves this?

Use Ansible in check mode to report differences but do not apply changes.

Use Ansible playbooks that enforce the desired state and run them on a schedule using Ansible Tower or AWX.

Use Ansible to deploy the baseline, but allow manual changes without any enforcement.

Use Ansible to deploy the baseline once and then never run it again.

GIAC Continuous Monitoring Certification

Domain 4Objective 3

Patching & Secure Baseline Configurations GMON Practice Questions (Page 7)

Part of the Configuration and Vulnerability Management domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 31–35

31foundation · easy
What is a secure baseline configuration?
Select an answer first
32foundation · easy
What is the primary purpose of configuration management tools like Ansible or Group Policy?
Select an answer first
33expert · hard
A vulnerability scan identifies a missing patch on a server that is part of a PCI-DSS compliant environment. The patch is rated medium severity and has no known exploit. The compliance team requires all medium vulnerabilities to be remediated within 30 days. What is the best action?
Select an answer first
34foundation · easy
What is a key input for continuously improving the patch management process?
Select an answer first
35application · medium
A company uses Ansible to manage its Linux servers. The security team wants to ensure that all servers have the same secure baseline configuration and that any changes are automatically reverted. Which Ansible approach best achieves this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.