Which challenge is most directly caused by the increasing use of encrypted network traffic?

Higher false positive rates in signature-based detection

Reduced visibility into the content of network communications

Increased storage requirements for packet captures

Slower network speeds due to encryption overhead

A company is deploying NSM sensors in a data center with multiple server racks. The network team wants to monitor east-west traffic between servers, but the core switches do not support SPAN ports. What is the most effective alternative to capture this traffic?

Install the sensor on the firewall's internal interface.

Place the sensor on the core switch's management port.

Deploy network TAPs inline on the inter-switch links.

Use NetFlow export from the servers' operating systems.

A network engineer is designing an NSM deployment for a critical server segment. The segment carries sensitive data and the security team requires full packet capture for forensic analysis. However, the switch does not support SPAN and the network cannot tolerate any inline device that could introduce latency. Which collection method should be used?

Deploy a passive network TAP on the link connecting the server segment to the core.

Use NetFlow export from the switch to collect flow data.

Configure the server's operating system to mirror traffic using a software agent.

Place an inline IDS between the server segment and the core.

A SOC has a mature NSM workflow that includes collection, detection, and alerting. However, analysts are spending too much time on low-fidelity alerts and missing high-priority incidents. Which workflow change would most effectively improve the prioritization of alerts?

Reduce the retention period for flow data to free up storage

Automatically close all alerts that are not confirmed within 10 minutes

Implement a risk-scoring system that combines asset criticality, threat intelligence, and alert context

Increase the number of IDS signatures to catch more threats

A SOC analyst receives an alert from the IDS about a potential SQL injection attempt against a web server. The analyst needs to determine if the attack succeeded. Which NSM workflow step should the analyst perform next?

Escalate the alert to the incident response team without further analysis

Disable the IDS signature that triggered the alert

Correlate the IDS alert with web server logs and full packet capture to verify the request and response

Immediately block the source IP address in the firewall

GIAC Certified Enterprise Defender

Domain 1Objective 4

Network Security Monitoring Concepts and Application GCED Practice Questions (Page 1)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
Which challenge is most directly caused by the increasing use of encrypted network traffic?
Select an answer first
2application · medium
A company is deploying NSM sensors in a data center with multiple server racks. The network team wants to monitor east-west traffic between servers, but the core switches do not support SPAN ports. What is the most effective alternative to capture this traffic?
Select an answer first
3expert · hard
A network engineer is designing an NSM deployment for a critical server segment. The segment carries sensitive data and the security team requires full packet capture for forensic analysis. However, the switch does not support SPAN and the network cannot tolerate any inline device that could introduce latency. Which collection method should be used?
Select an answer first
4expert · hard
A SOC has a mature NSM workflow that includes collection, detection, and alerting. However, analysts are spending too much time on low-fidelity alerts and missing high-priority incidents. Which workflow change would most effectively improve the prioritization of alerts?
Select an answer first
5application · medium
A SOC analyst receives an alert from the IDS about a potential SQL injection attempt against a web server. The analyst needs to determine if the attack succeeded. Which NSM workflow step should the analyst perform next?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.