A hospital network has a public-facing patient portal and an internal electronic health record (EHR) system. The security team is redesigning the network to ensure that a compromise of the portal cannot directly reach the EHR. Which design pattern should they implement?

Use a single flat network and rely on endpoint protection on the EHR servers to stop any attacks.

Place the portal in a DMZ and the EHR in a separate internal zone with firewall rules allowing only necessary traffic.

Deploy an IDS/IPS inline between the portal and the EHR to detect and block any malicious traffic.

Move the EHR to the same DMZ as the portal so both are equally protected by the perimeter firewall.

A company's security team is designing a monitoring strategy for a new office building. They want to detect unauthorized physical access to the server room and correlate it with suspicious login activity on the servers. Which combination of monitoring sources best achieves this?

A physical intrusion detection system on the server room door and antivirus alerts from the servers.

Network flow logs from the office switch and firewall logs from the edge firewall.

CCTV footage stored locally and server performance counters collected by a monitoring agent.

Door access logs from the badge system and authentication logs from the servers, both fed into a SIEM.

A security architect is using TOGAF to develop an enterprise security architecture. The architect needs to define the target state for security monitoring, including what data to collect and where. Which TOGAF phase is most relevant for defining this target state?

Technology Architecture (Phase D)

Business Architecture (Phase B)

Information Systems Architecture (Phase C)

A company has deployed a SIEM that collects logs from firewalls, servers, and endpoints. The security team wants to improve detection of insider threats by adding a monitoring layer that focuses on user behavior. Which component should they add?

A file integrity monitoring (FIM) tool that detects changes to critical files.

A vulnerability scanner that identifies missing patches on user workstations.

User and Entity Behavior Analytics (UEBA) that profiles normal user activity and alerts on deviations.

A network-based IDS that inspects all inbound and outbound traffic.

In the context of continuous monitoring, what is the primary role of a security architecture?

To ensure that all monitoring data is stored in a single location

To automatically block all detected threats without human intervention

To replace the need for security monitoring tools

To provide a framework for determining what to monitor, where to collect data, and how to respond to threats

GIAC Continuous Monitoring Certification

Domain 1Objective 2

Security Architecture Overview GMON Practice Questions (Page 1)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 1–5

1application · medium
A hospital network has a public-facing patient portal and an internal electronic health record (EHR) system. The security team is redesigning the network to ensure that a compromise of the portal cannot directly reach the EHR. Which design pattern should they implement?
Select an answer first
2application · medium
A company's security team is designing a monitoring strategy for a new office building. They want to detect unauthorized physical access to the server room and correlate it with suspicious login activity on the servers. Which combination of monitoring sources best achieves this?
Select an answer first
3application · medium
A security architect is using TOGAF to develop an enterprise security architecture. The architect needs to define the target state for security monitoring, including what data to collect and where. Which TOGAF phase is most relevant for defining this target state?
Select an answer first
4application · medium
A company has deployed a SIEM that collects logs from firewalls, servers, and endpoints. The security team wants to improve detection of insider threats by adding a monitoring layer that focuses on user behavior. Which component should they add?
Select an answer first
5foundation · easy
In the context of continuous monitoring, what is the primary role of a security architecture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.