A SOC receives a new threat intelligence report that describes a technique not currently covered by any detection rule. The SOC wants to implement a detection for this technique. What is the first step in the continuous improvement cycle?

Map the technique to the MITRE ATT&CK framework and assess the current detection coverage.

Share the report with the incident response team for future reference.

Wait for the technique to be observed in the environment before creating a rule.

Create a detection rule for the technique and deploy it immediately.

What is the primary purpose of adversary emulation in security monitoring?

To replace the need for penetration testing

To ensure that all security patches are applied correctly

To test and improve the ability of monitoring systems to detect real attack techniques

To train security analysts in incident response procedures

What is the most direct way threat intelligence influences detection rules?

It provides the exact IP addresses of all malicious actors worldwide

It eliminates false positives by guaranteeing that only real attacks trigger alerts

It supplies the indicators and behavioral patterns that rules are designed to match

It automatically updates firewall rules to block all malicious traffic

Which step is a typical part of the continuous improvement cycle for monitoring?

Conducting post-incident reviews and applying lessons learned to detection rules

Waiting for a major breach before making any changes to monitoring

Deleting all logs after a certain period to reduce storage costs

Freezing all detection rules to maintain a stable baseline

A security team has a detection rule that was created based on a threat intelligence report from six months ago. The rule has not generated any alerts, and the team is unsure if it is still relevant. What should the team do as part of the continuous improvement cycle?

Increase the alert threshold to reduce noise.

Delete the rule because it has not generated alerts.

Review the rule against current threat intelligence to determine if the technique is still relevant and update it accordingly.

Keep the rule unchanged because it was based on intelligence.

GIAC Continuous Monitoring Certification

Domain 1Objective 3

Threat Informed Defense GMON Practice Questions (Page 4)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 16–20

16application · medium
A SOC receives a new threat intelligence report that describes a technique not currently covered by any detection rule. The SOC wants to implement a detection for this technique. What is the first step in the continuous improvement cycle?
Select an answer first
17foundation · easy
What is the primary purpose of adversary emulation in security monitoring?
Select an answer first
18foundation · easy
What is the most direct way threat intelligence influences detection rules?
Select an answer first
19foundation · easy
Which step is a typical part of the continuous improvement cycle for monitoring?
Select an answer first
20application · medium
A security team has a detection rule that was created based on a threat intelligence report from six months ago. The rule has not generated any alerts, and the team is unsure if it is still relevant. What should the team do as part of the continuous improvement cycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.