During an incident response, an analyst needs to preserve evidence from a compromised server. The analyst has captured network traffic and collected system logs. What is the most important next step to ensure the evidence is admissible in court?

Delete any irrelevant data to simplify the evidence set.

Copy the evidence to a secure location and document the chain of custody.

Analyze the evidence immediately to identify the attacker.

Share the evidence with all team members for collaborative analysis.

Why can encryption make intrusion detection more difficult?

It hides the payload content from inspection

It prevents the IDS from seeing the TCP headers

It changes the source and destination IP addresses

It increases the size of packets, causing performance issues

Where is a network-based IDS (NIDS) typically placed to monitor traffic entering an organization's network from the internet?

On the internal switch connecting all workstations

Behind the firewall on the DMZ or internal network boundary

Which network traffic behavior is commonly associated with data exfiltration?

A host sending large amounts of data to an external IP address during off-hours

A host performing a DNS query for a commonly used website

A host receiving a software update from a vendor's patch server

A host sending periodic keep-alive packets to a VPN gateway

GIAC Certified Enterprise Defender

Domain 1Objective 3

Intrusion Detection and Packet Analysis GCED Practice Questions (Page 6)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

Questions 26–30

26foundation · easy
Which protocol is connection-oriented and provides reliable, ordered delivery of data?
Select an answer first
27application · medium
During an incident response, an analyst needs to preserve evidence from a compromised server. The analyst has captured network traffic and collected system logs. What is the most important next step to ensure the evidence is admissible in court?
Select an answer first
28foundation · easy
Why can encryption make intrusion detection more difficult?
Select an answer first
29foundation · easy
Where is a network-based IDS (NIDS) typically placed to monitor traffic entering an organization's network from the internet?
Select an answer first
30foundation · easy
Which network traffic behavior is commonly associated with data exfiltration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.