A new SOC analyst asks why the organization's monitoring strategy is based on threat intelligence and adversary behavior rather than just a list of known malware signatures. Which response best explains the role of threat informed defense in security monitoring?

Threat informed defense is a framework for incident response, not for monitoring.

Threat informed defense is a regulatory requirement that mandates specific monitoring tools.

Threat informed defense uses knowledge of adversary tactics, techniques, and procedures to prioritize monitoring and detection, making the SOC more effective against evolving threats.

Threat informed defense relies on a comprehensive list of malware signatures to block all known threats.

After a security incident, the SOC reviews the timeline and finds that a detection rule failed to alert because the attacker used a new obfuscation technique. The team wants to improve the rule. Which action best fits the continuous improvement cycle?

Submit a request to the threat intelligence team for more indicators related to the attack.

Delete the detection rule because it failed to catch the attack.

Update the detection rule to include the new obfuscation pattern and schedule a review of the rule's performance after a month.

Add the specific obfuscation string to a blocklist and move on.

A detection engineer is writing a rule to detect a specific adversary technique. The threat intelligence report indicates the technique is commonly used by a particular threat group but also appears in legitimate administrative activity. What is the best approach to minimize false positives while maintaining detection capability?

Set the rule to trigger on every instance of the technique without any additional context.

Add context such as the presence of other related behaviors or specific command-line arguments to the detection rule.

Only enable the rule during off-hours when administrative activity is less likely.

Disable the rule because it will generate too many alerts.

A security manager wants to justify the adoption of threat informed defense to the executive team. Which benefit should the manager highlight as the primary advantage of this approach?

It ensures compliance with all regulatory requirements.

It reduces the need for security monitoring tools.

It eliminates the risk of cyber attacks.

It aligns security investments with the most relevant threats, improving the efficiency and effectiveness of monitoring.

What is the core idea behind threat-informed detection engineering?

Writing detection rules that are based on industry best practices without modification

Writing detection rules that are easy to maintain and document

Writing detection rules based on the known behaviors and techniques of adversaries

Writing detection rules that generate the highest possible number of alerts

GIAC Continuous Monitoring Certification

Domain 1Objective 3

Threat Informed Defense GMON Practice Questions (Page 6)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 26–30

26application · easy
A new SOC analyst asks why the organization's monitoring strategy is based on threat intelligence and adversary behavior rather than just a list of known malware signatures. Which response best explains the role of threat informed defense in security monitoring?
Select an answer first
27application · medium
After a security incident, the SOC reviews the timeline and finds that a detection rule failed to alert because the attacker used a new obfuscation technique. The team wants to improve the rule. Which action best fits the continuous improvement cycle?
Select an answer first
28application · medium
A detection engineer is writing a rule to detect a specific adversary technique. The threat intelligence report indicates the technique is commonly used by a particular threat group but also appears in legitimate administrative activity. What is the best approach to minimize false positives while maintaining detection capability?
Select an answer first
29application · easy
A security manager wants to justify the adoption of threat informed defense to the executive team. Which benefit should the manager highlight as the primary advantage of this approach?
Select an answer first
30foundation · easy
What is the core idea behind threat-informed detection engineering?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.