A security operations center (SOC) is planning to implement a network monitoring program. They have limited staff and budget. Which approach provides the best balance of coverage and cost?

Outsource all monitoring to a managed security service provider (MSSP)

Centralize log collection and use open-source analysis tools

Deploy full packet capture on every network segment

Use only free threat intelligence feeds and no paid tools

A SOC manager wants to demonstrate the value of the monitoring program to executives. Which metric would best show the reduction in risk due to monitoring?

Number of incidents detected by monitoring versus those reported by users.

Total number of security alerts generated.

Average time to patch vulnerabilities.

Number of firewall rules added per month.

Which technique is used to detect anomalies by establishing a baseline of normal network behavior?

Statistical analysis of traffic patterns

A SOC is considering integrating a commercial threat intelligence feed that provides IP and domain indicators. The feed has a high false-positive rate, and the SOC is already overwhelmed with alerts. How should the SOC proceed to improve detection without increasing alert fatigue?

Integrate the feed into the SIEM and create alerts for all matches, then tune the rules based on feedback.

Ignore the feed because of the high false-positive rate.

Block all IPs from the feed at the firewall without alerting.

Use the feed to enrich alerts rather than generate new alerts, and only alert on high-confidence matches.

GIAC Critical Controls Certification

Domain 5Objective 3

Network Monitoring and Defense GCCC Practice Questions (Page 5)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 21–25

21expert · hard
A security operations center (SOC) is planning to implement a network monitoring program. They have limited staff and budget. Which approach provides the best balance of coverage and cost?
Select an answer first
22application · medium
A SOC manager wants to demonstrate the value of the monitoring program to executives. Which metric would best show the reduction in risk due to monitoring?
Select an answer first
23foundation · easy
Which technique is used to detect anomalies by establishing a baseline of normal network behavior?
Select an answer first
24expert · hard
A SOC is considering integrating a commercial threat intelligence feed that provides IP and domain indicators. The feed has a high false-positive rate, and the SOC is already overwhelmed with alerts. How should the SOC proceed to improve detection without increasing alert fatigue?
Select an answer first
25application · medium
A security operations center (SOC) receives a threat intelligence feed that lists a set of malicious IP addresses. The SOC wants to detect any internal host communicating with these IPs. Which log source is most directly useful for this detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.