Which network defense technology inspects traffic at the application layer and can block malicious payloads?

Next-generation firewall (NGFW)

A security analyst is investigating a potential data exfiltration incident. They have access to NetFlow data and full packet capture. Which technique would be most effective for identifying the data that was exfiltrated?

Analyze the full packet capture for the content of the outbound connections

Use DNS logs to see which domains were resolved

Check the firewall logs for the destination IPs

Review NetFlow records for the volume and duration of outbound connections

A security team is integrating multiple threat intelligence feeds into their SIEM. One feed is a commercial feed with high confidence indicators, and another is a free community feed with many false positives. The team wants to reduce alert fatigue while maintaining high detection capability. How should they configure the correlation rules?

Use the commercial feed for immediate alerts and the community feed only as a secondary correlation source

Do not use the community feed at all

Use the community feed for immediate alerts and the commercial feed for reporting

Use both feeds for immediate alerts to maximize coverage

A company's finance department handles sensitive payment data, while the marketing department frequently accesses external websites. Both departments are on the same flat network segment. After a malware infection in marketing, the finance team's systems were also compromised. Which network defense change would most effectively limit the blast radius of future incidents?

Enable MAC address filtering on the network switches to restrict which devices can connect.

Increase the frequency of antivirus scans on all workstations.

Deploy an intrusion prevention system (IPS) at the internet edge to block malicious traffic before it reaches the internal network.

Implement VLAN segmentation to separate finance and marketing traffic, with firewall rules allowing only necessary communication.

GIAC Critical Controls Certification

Domain 5Objective 3

Network Monitoring and Defense GCCC Practice Questions (Page 7)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 31–35

31foundation · easy
Which network defense technology inspects traffic at the application layer and can block malicious payloads?
Select an answer first
32application · medium
A security analyst is investigating a potential data exfiltration incident. They have access to NetFlow data and full packet capture. Which technique would be most effective for identifying the data that was exfiltrated?
Select an answer first
33expert · hard
A security team is integrating multiple threat intelligence feeds into their SIEM. One feed is a commercial feed with high confidence indicators, and another is a free community feed with many false positives. The team wants to reduce alert fatigue while maintaining high detection capability. How should they configure the correlation rules?
Select an answer first
34application · medium
A company's finance department handles sensitive payment data, while the marketing department frequently accesses external websites. Both departments are on the same flat network segment. After a malware infection in marketing, the finance team's systems were also compromised. Which network defense change would most effectively limit the blast radius of future incidents?
Select an answer first
35foundation · easy
What is the first step in the incident detection and response process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Network Monitoring and Defense GCCC Practice Questions (Page 7)

Questions 31–35

Which network defense technology inspects traffic at the application layer and can block malicious payloads?

A security analyst is investigating a potential data exfiltration incident. They have access to NetFlow data and full packet capture. Which technique would be most effective for identifying the data that was exfiltrated?

What is the first step in the incident detection and response process?

Keep studying — Security Operations and Monitoring