An analyst is establishing a network baseline for a new office location. The office has just opened and has been operational for two days. The analyst wants to detect anomalies as soon as possible. What is the most appropriate approach to baseline establishment?

Set thresholds based on vendor-recommended values for the network equipment.

Use the two days of data as the baseline and set thresholds tightly to catch any deviation.

Wait at least 30 days to collect data before establishing a baseline, and use that data to set thresholds.

Use a baseline from a similar existing office and apply it directly to the new office.

An organization is integrating a commercial threat intelligence feed into its SIEM. The feed contains a large number of IP addresses that are flagged as malicious. The analyst notices that several internal IP addresses are also present in the feed, which are clearly not malicious. What is the most appropriate way to handle this?

Ignore the internal IPs in the feed because they are not relevant to the organization.

Create an allowlist for internal IP addresses and apply it to the threat intelligence matching logic.

Disable the entire threat intelligence feed because it contains false positives.

Contact the threat intelligence vendor to have the internal IPs removed from the feed.

A vulnerability scan of a hospital network has identified multiple assets with critical vulnerabilities. The assets include an MRI machine, a patient records database, and a guest Wi-Fi access point. The analyst must prioritize remediation. Which asset should be remediated first?

The guest Wi-Fi access point, because it is exposed to the public.

The patient records database, because it contains sensitive data and is likely accessible to more users.

The MRI machine, because it has the highest CVSS score.

All assets equally, because all have critical vulnerabilities.

What is the main purpose of log and event correlation?

To replace the need for intrusion detection systems

To delete old logs to save storage

To combine data from multiple sources to identify patterns indicative of security threats

What is the purpose of classifying assets by criticality?

To prioritize monitoring and protection efforts on the most important assets

To replace the need for vulnerability scanning

To determine the physical location of assets

To assign IP addresses to devices

GIAC Certified Detection Analyst

Domain 3Objective 1

Asset and Network Analytics GCDA Practice Questions (Page 6)

Part of the Network and Asset Analytics domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 6–10 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

12concepts

Questions 26–30

26application · medium
An analyst is establishing a network baseline for a new office location. The office has just opened and has been operational for two days. The analyst wants to detect anomalies as soon as possible. What is the most appropriate approach to baseline establishment?
Select an answer first
27expert · hard
An organization is integrating a commercial threat intelligence feed into its SIEM. The feed contains a large number of IP addresses that are flagged as malicious. The analyst notices that several internal IP addresses are also present in the feed, which are clearly not malicious. What is the most appropriate way to handle this?
Select an answer first
28application · medium
A vulnerability scan of a hospital network has identified multiple assets with critical vulnerabilities. The assets include an MRI machine, a patient records database, and a guest Wi-Fi access point. The analyst must prioritize remediation. Which asset should be remediated first?
Select an answer first
29foundation · easy
What is the main purpose of log and event correlation?
Select an answer first
30foundation · easy
What is the purpose of classifying assets by criticality?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.