Which activity is a key part of refining detection analytics using threat information?

Keeping detection rules static to ensure consistency

Deleting all detection rules that have ever produced a false positive

Regularly reviewing and updating detection rules based on new adversary techniques

Increasing the alert threshold to reduce noise

What is the primary goal of a threat informed defense strategy in security monitoring?

To replace human analysts with machine learning models

To eliminate all security alerts by deploying more automated tools

To ensure compliance with all relevant regulations and standards

To prioritize monitoring and response efforts based on the tactics, techniques, and procedures of real adversaries

A security team regularly reviews detection rules and removes those that have not generated alerts in the past six months. A new threat intelligence report indicates an increase in a specific attack technique that the team had previously deprioritized. What should the team do?

Only add the detection if the threat intelligence provider offers a discount.

Reintroduce and refine detection rules for that technique based on the new intelligence.

Continue to deprioritize the technique because it has not been seen recently.

Wait until the technique is actually observed in the environment before adding detections.

A security analyst is reviewing threat intelligence that includes a list of malicious IP addresses and domains. The analyst wants to use this intelligence to improve detection. Which approach is most effective?

Use the intelligence to understand the adversary's TTPs and create behavior-based detection rules that focus on the techniques used.

Create firewall rules to block all the listed IP addresses and domains.

Store the intelligence in a threat intel platform and do nothing else.

Create detection rules that alert on any traffic to or from the listed IP addresses and domains.

A SOC has a detection rule that has been in place for six months. The rule has a low false positive rate, but the SOC is concerned that it may not detect newer variations of the threat. The threat intelligence team has provided updated information on the threat actor's evolving techniques. What is the best course of action?

Keep the rule as is because it has a low false positive rate.

Update the rule based on the new intelligence and then run adversary emulation to validate that it still detects the original and new variations.

Delete the rule and create a completely new one based on the new intelligence.

Submit the new intelligence to the threat intel platform and continue monitoring.

GIAC Continuous Monitoring Certification

Domain 1Objective 3

Threat Informed Defense GMON Practice Questions (Page 7)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 31–35

31foundation · easy
Which activity is a key part of refining detection analytics using threat information?
Select an answer first
32foundation · easy
What is the primary goal of a threat informed defense strategy in security monitoring?
Select an answer first
33application · medium
A security team regularly reviews detection rules and removes those that have not generated alerts in the past six months. A new threat intelligence report indicates an increase in a specific attack technique that the team had previously deprioritized. What should the team do?
Select an answer first
34application · medium
A security analyst is reviewing threat intelligence that includes a list of malicious IP addresses and domains. The analyst wants to use this intelligence to improve detection. Which approach is most effective?
Select an answer first
35expert · hard
A SOC has a detection rule that has been in place for six months. The rule has a low false positive rate, but the SOC is concerned that it may not detect newer variations of the threat. The threat intelligence team has provided updated information on the threat actor's evolving techniques. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.