A SOC team wants to validate that their detection rules for a specific adversary group are effective. They have a test environment that mirrors production. Which adversary emulation approach is most appropriate?

Manually execute the techniques in the test environment and check if alerts fire.

Use a breach and attack simulation platform to continuously run emulations of the adversary's techniques and report on detection coverage.

Wait for a real attack to occur and then validate the rules.

Review the detection rules against the MITRE ATT&CK framework to ensure coverage.

A SOC has implemented a new detection rule based on a threat intelligence report. After a month, the team reviews the rule's performance and finds that it has generated many false positives. What is the best next step in the continuous improvement cycle?

Delete the rule because it is not working well.

Ignore the false positives and keep the rule as is.

Adjust the rule's thresholds or conditions to reduce false positives, and then re-test it with adversary emulation.

Submit a request to the threat intelligence team for more specific indicators.

A company's SOC has implemented new detection rules based on a recent threat report. The team wants to validate that the rules actually fire when an attacker uses the described techniques. Which approach best tests the monitoring capabilities in a controlled way?

Run a penetration test against the production environment using the same tools and techniques described in the threat report.

Use an adversary emulation tool, such as Atomic Red Team, to execute the specific techniques in a test environment and verify that the corresponding alerts are generated.

Wait for a real attack to occur and then check if the alerts fire.

Review the detection rules manually to ensure they match the threat report's indicators.

A security operations center (SOC) receives a threat intelligence report describing a new campaign that uses PowerShell to download a payload from a specific domain and then executes it via a scheduled task. The SOC wants to create a detection that will alert on this activity. Which approach best applies threat-informed detection engineering?

Create a detection rule that alerts on any PowerShell process that includes the specific domain name in its command line.

Create a detection rule that alerts on any PowerShell process that includes the specific domain name in its command line, and also create a rule that alerts on any scheduled task creation that references PowerShell.

Create a detection rule that alerts on any PowerShell process that includes the specific domain name in its command line, and also create a rule that alerts on any scheduled task creation that references PowerShell, and also create a rule that alerts on any process that downloads from the specific domain.

Map the campaign to the MITRE ATT&CK framework, then create detection rules that cover the relevant techniques, such as PowerShell execution, scheduled task creation, and command-line obfuscation.

A security architect is designing a monitoring strategy for an organization that faces a diverse set of threats, including opportunistic malware and targeted APT groups. The architect wants to implement threat informed defense. Which approach best balances the need to cover both types of threats?

Focus all monitoring on opportunistic malware because it is more common.

Implement a single detection rule that covers all possible threats.

Use threat intelligence to prioritize monitoring for the most relevant threats, while maintaining a baseline of detection for common malware.

Focus all monitoring on the APT groups because they pose the highest risk.

GIAC Continuous Monitoring Certification

Domain 1Objective 3

Threat Informed Defense GMON Practice Questions (Page 5)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 21–25

21application · medium
A SOC team wants to validate that their detection rules for a specific adversary group are effective. They have a test environment that mirrors production. Which adversary emulation approach is most appropriate?
Select an answer first
22application · medium
A SOC has implemented a new detection rule based on a threat intelligence report. After a month, the team reviews the rule's performance and finds that it has generated many false positives. What is the best next step in the continuous improvement cycle?
Select an answer first
23application · medium
A company's SOC has implemented new detection rules based on a recent threat report. The team wants to validate that the rules actually fire when an attacker uses the described techniques. Which approach best tests the monitoring capabilities in a controlled way?
Select an answer first
24application · medium
A security operations center (SOC) receives a threat intelligence report describing a new campaign that uses PowerShell to download a payload from a specific domain and then executes it via a scheduled task. The SOC wants to create a detection that will alert on this activity. Which approach best applies threat-informed detection engineering?
Select an answer first
25expert · hard
A security architect is designing a monitoring strategy for an organization that faces a diverse set of threats, including opportunistic malware and targeted APT groups. The architect wants to implement threat informed defense. Which approach best balances the need to cover both types of threats?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.