A security manager wants to shift the monitoring program from a compliance-driven approach to a threat-informed defense. Which change best reflects this shift?

Implement all possible detections regardless of relevance to the organization's threat profile.

Use only open-source threat intelligence feeds because they are free.

Prioritize monitoring controls that map to the tactics, techniques, and procedures of adversaries likely to target the organization.

Focus exclusively on meeting regulatory logging requirements to avoid penalties.

A security operations team receives a threat intelligence report that includes both indicators of compromise (IOCs) and behavioral descriptions of a new adversary. The team wants to improve detection. Which approach is most effective?

Use the behavioral descriptions to create detection rules that focus on the adversary's techniques, and use the IOCs for enrichment.

Use only the IOCs to create detection rules because they are specific.

Use only the behavioral descriptions because IOCs are not useful.

Wait for more intelligence before creating any rules.

A security team has a mature detection program. They receive a new threat intelligence report that describes a technique that is not currently covered by any detection rule. The team has limited development resources and must decide whether to build a new rule or update an existing one. What should they do first?

Immediately build a new rule for the technique because it is new.

Assess the likelihood and impact of the technique being used against the organization, and compare it to the risk of existing gaps.

Wait for the next threat intelligence report before making any decisions.

Update all existing rules to include the new technique's indicators.

GIAC Continuous Monitoring Certification

Domain 1Objective 3

Threat Informed Defense GMON Practice Questions (Page 8)

Part of the Security Monitoring Foundations domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 36–38

36application · medium
A security manager wants to shift the monitoring program from a compliance-driven approach to a threat-informed defense. Which change best reflects this shift?
Select an answer first
37expert · hard
A security operations team receives a threat intelligence report that includes both indicators of compromise (IOCs) and behavioral descriptions of a new adversary. The team wants to improve detection. Which approach is most effective?
Select an answer first
38expert · hard
A security team has a mature detection program. They receive a new threat intelligence report that describes a technique that is not currently covered by any detection rule. The team has limited development resources and must decide whether to build a new rule or update an existing one. What should they do first?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Threat Informed Defense GMON Practice Questions (Page 8)

Questions 36–38

A security manager wants to shift the monitoring program from a compliance-driven approach to a threat-informed defense. Which change best reflects this shift?

A security operations team receives a threat intelligence report that includes both indicators of compromise (IOCs) and behavioral descriptions of a new adversary. The team wants to improve detection. Which approach is most effective?

Keep studying — Security Monitoring Foundations