Threat Informed Defense GMON Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center receives a threat intelligence feed that includes a list of malicious IP addresses. The team wants to use this intelligence to improve monitoring. What is the most effective way to integrate this feed?

   • ABlock all the IP addresses at the firewall without further analysis.
   • BShare the IP addresses with other organizations but do not use them internally.
   • CStore the IP addresses in a spreadsheet for future reference.
   • DIngest the IP addresses into the SIEM and create alerts for any traffic to or from these addresses.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team has implemented a new detection rule for credential dumping based on a recent threat intelligence report. Before relying on it, the team wants to validate that the rule actually fires when the adversary's technique is used. Which action best tests the detection capability?

   • AAsk the threat intelligence provider to confirm the rule is effective.
   • BRun a simulated credential dumping attack in a test environment using the same tools and techniques described in the intelligence report.
   • CReview the detection rule's syntax and confirm it matches the MITRE ATT&CK technique ID.
   • DDeploy the rule to production and wait for a real attack to occur.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is planning an adversary emulation exercise. They have a limited budget and cannot emulate all techniques. They want to maximize the improvement to their monitoring capabilities. Which approach is most effective?

   • AEmulate only the techniques that are easiest to execute to save time.
   • BEmulate all techniques but only once per year.
   • CEmulate a random sample of techniques to get a broad overview.
   • DEmulate the techniques that are most likely to be used by adversaries targeting the organization, and use the results to refine detection rules.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security manager is evaluating the organization's monitoring program. The program currently uses a compliance checklist to determine what to monitor. The manager wants to adopt a threat-informed defense approach. Which change is most critical?

   • AReplace all existing monitoring tools with new ones.
   • BShift from compliance-driven monitoring to monitoring based on the organization's specific threat landscape and adversary behaviors.
   • CIncrease the number of monitoring tools to collect more data.
   • DFocus on compliance requirements but add more frequent audits.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of the continuous improvement cycle in threat-informed monitoring?

   • ATo ensure that monitoring tools are replaced every year
   • BTo use feedback from incidents and threat intelligence to constantly update monitoring and response
   • CTo document all security incidents for compliance purposes
   • DTo perform a one-time assessment of monitoring capabilities
   Reveal Solution Discussion Select an answer first