GIAC GMON Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Continuous Monitoring (GMON) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GMON certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GMON Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Continuous Monitoring (GMON) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Continuous Monitoring exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GMON Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GMON Sample Questions:
01. Reconstructing an intrusion on a county government member server, an analyst learns that the intruder, using the account svc_report, first set the Audit Policy Change subcategory to No Auditing and then changed logon auditing. No logon events appear after that point. The Security log still holds this record:
Event ID: 4719 Subject Account Name: svc_report Category: Logon/Logoff Subcategory: Logon Changes: Success removed, Failure removed
What does this record establish about the second change?
a) It records svc_report removing logon auditing, and it is genuine even though Audit Policy Change auditing was already off
b) It marks the Security log being cleared, and the earlier events are gone
c) It cannot be trusted, because no 4719 is written once Audit Policy Change is set to No Auditing
d) It shows svc_report logging on at the moment the new policy took effect
02. At a regional hospital, workstations run Windows Defender Firewall at its default settings, and the only rules deployed centrally are inbound rules. Malware on one workstation connects to an internet host on TCP 443 every five minutes, and the host firewall does not block it.
Why did the host firewall let this traffic out?
a) Encrypted traffic on port 443 cannot be matched by host firewall rules
b) A host firewall filters inbound traffic only, and outbound connections pass unchecked
c) The connection was a reply to a session that began on the internet
d) By default it allows outbound connections unless an outbound rule blocks them, and none was deployed
03. From the user VLAN, a school district's network engineer is authorized to check which TCP ports the router ACL in front of the server subnet passes or blocks. The router filters packets statelessly, and its entries match only addresses and ports, with no entry for established traffic. Which services are running behind it does not matter for this task.
Which nmap scan type fits?
a) nmap -sL, a list scan of target hosts
b) nmap -sU, a UDP scan
c) nmap -sA, a TCP ACK scan
d) nmap -sn, ping sweep
04. The patch tool at a water utility reports success on an application server, and an authenticated check confirms the updated library files are on disk. A network check of the running service still reports the vulnerable version; the service has run continuously since before the patch was installed.
What should the engineer do next?
a) Restart the service so the patched code loads, then verify the running version again
b) Close the network finding as a false positive, since the files on disk are already updated
c) Reinstall the patch, since the installation evidently failed on this server
d) Add an IPS signature as a compensating control until next month's cycle
05. A threat model for a pharmaceutical company's new zero trust deployment concludes that an attacker who compromised the policy administrator could approve sessions for subverted devices.
Which two design measures protect the decision components?
(Choose two.)
a) Let user devices and resources query the policy engine directly over the shared data plane
b) Make the policy management console reachable from the help-desk VLAN for routine rule edits
c) Cache each allow decision on the endpoint agent for the workday
d) Carry policy decision and enforcement traffic on a logically separate control plane
e) Audit every policy change and limit edits to designated admins
06. A county government's network engineer is reviewing the inbound rules on the border router and firewall, which already drop packets with RFC 1918 source addresses.
Which two further kinds of inbound traffic should be blocked at the perimeter?
(Choose two.)
a) Return packets belonging to sessions that internal hosts opened to the internet
b) SMTP to the mail relay
c) Packets that carry IP source-routing options
d) Packets from the internet addressed to an internal subnet's broadcast address
e) HTTPS requests to the public web server in the DMZ
07. Ransomware encrypts a manufacturer's file servers. Tested offline backups restore every server within two days. The group then publishes sample design files taken from those servers and demands payment to withhold the rest.
Which two statements about this incident are correct?
(Choose two.)
a) The encryption step itself transmitted copies of the files to the group
b) The backups must have been incomplete, which left the group its leverage
c) The published samples show that the group also reached the offline backup store and copied files from it
d) The files were copied out before encryption, so restoring every server cannot remove the group's threat to publish them
e) A large outbound transfer of the file servers' data before encryption was the stage to detect
08. Before reviewing perimeter coverage at a university, a security architect is inventorying the network's points of access. Which two belong on that inventory?
(Choose two.)
a) Inter-VLAN routing on the core switch between the user and server VLANs
b) A cellular modem giving a lab workstation its own internet link
c) The SPAN port that copies core switch traffic to the network security sensor
d) The SIEM collector receiving syslog from internal servers
e) A guest wireless network running over its own broadband line
09. After a phishing incident at a regional hospital, responders find a commercial remote-support tool, not the hospital's approved remote monitoring and management (RMM) product, on six workstations: four installed it as a service, and two ran it as a portable executable from the Downloads folder. Every copy holds a long-lived outbound connection to the tool vendor's servers. Proxy and DNS logs are collected centrally, while endpoint logs stay on each workstation.
Which detection would find every copy of this tool on the hospital's other workstations?
a) A comparison of each workstation's installed-programs list against the approved RMM product
b) Alerting on proxy and DNS records of connections to the tool vendor's relay domains
c) Updated antivirus signatures pushed to every workstation and server in the hospital's clinical network
d) A network IPS signature for exploitation attempts against the remote-support product's listening service
10. During a resilience test at a logistics company, a traffic flood against the on-premises zero trust policy administrator left every user unable to open new sessions to any resource for two hours.
Which change best reduces this risk while keeping zero trust enforcement in place?
a) Issue session credentials and tokens that stay valid for 30 days at a time
b) Configure the enforcement points to allow all sessions whenever the policy administrator is unreachable
c) Replicate the policy engine and administrator across several locations
d) Place a NIDS before the policy administrator
Answers:
|
Question: 01 Answer: a |
Question: 02 Answer: d |
Question: 03 Answer: c |
Question: 04 Answer: a |
Question: 05 Answer: d, e |
|
Question: 06 Answer: c, d |
Question: 07 Answer: d, e |
Question: 08 Answer: b, e |
Question: 09 Answer: b |
Question: 10 Answer: c |
Note: For any error in GIAC Continuous Monitoring (GMON) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
