What is the primary purpose of correlating IDS alerts from multiple sources?

To reduce the number of alerts generated by the IDS

To increase the sensitivity of the IDS sensors

To identify multi-step attacks and reduce false positives

To automatically block malicious IP addresses

An analyst is examining a pcap and sees an HTTP request with a URL containing encoded characters: %2e%2e%2fetc%2fpasswd. What does this indicate?

A cross-site scripting (XSS) attempt

Which factor is most likely to contribute to a high rate of false positives in an IDS?

Lack of encryption on the network

Overly broad detection signatures

Using a host-based IDS instead of a network-based IDS

During an incident, an analyst captures network traffic related to a suspected data exfiltration. The analyst needs to preserve the evidence for potential legal proceedings. Which action is most important?

Create a cryptographic hash of the pcap file and store it securely

Open the pcap in Wireshark and take screenshots of the suspicious packets

Email the pcap file to the incident response team for analysis

Save the pcap file to the analyst's local workstation for quick access

GIAC Certified Enterprise Defender

Domain 1Objective 3

Intrusion Detection and Packet Analysis GCED Practice Questions (Page 2)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

Questions 6–10

6foundation · easy
What is the primary purpose of correlating IDS alerts from multiple sources?
Select an answer first
7foundation · easy
In Wireshark, which display filter would show only packets that use the HTTP protocol?
Select an answer first
8application · medium
An analyst is examining a pcap and sees an HTTP request with a URL containing encoded characters: %2e%2e%2fetc%2fpasswd. What does this indicate?
Select an answer first
9foundation · easy
Which factor is most likely to contribute to a high rate of false positives in an IDS?
Select an answer first
10application · medium
During an incident, an analyst captures network traffic related to a suspected data exfiltration. The analyst needs to preserve the evidence for potential legal proceedings. Which action is most important?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.