What is the typical first step in the incident response process after an IDS generates an alert?

Escalate the alert to law enforcement

Immediately disconnect the affected system from the network

Delete the alert to reduce noise

Triage the alert to verify whether it is a true positive or false positive

A security analyst is reviewing flow records from a server that normally receives about 100 inbound connections per day from a small set of known IP addresses. Over the past hour, the server has received 5,000 inbound connections from thousands of different source IP addresses, all targeting the same port. The analyst wants to determine whether this is an attack or a legitimate spike. Which additional data source would be most useful to confirm the nature of the activity?

Full packet capture of the traffic to the server

A list of the server's open ports

The server's CPU and memory utilization logs

In a typical network topology, where is a network-based IDS sensor most commonly placed to monitor inbound and outbound traffic?

Behind the firewall on the internal network

At the network perimeter, between the router and the firewall

In front of the firewall on the internet-facing side

Which statement best describes how an intrusion detection system (IDS) fits into a network security architecture?

It is a physical security control that protects network equipment from tampering

It is a compensating control that replaces the need for regular security audits

It is a preventive control that stops attacks before they reach the target

It is a detective control that provides visibility into suspicious activity and supports incident response

A company wants to detect an attacker who is using a compromised web server to send spam emails. The attacker is modifying the web server's configuration files and using a legitimate email library. Which type of IDS would be most effective at detecting this activity?

A network-based IDS placed on the DMZ segment

A hybrid IDS that only monitors network traffic

A network-based IDS placed at the perimeter

A host-based IDS on the web server

GIAC Certified Intrusion Analyst

Domain 3Objective 1

IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 1)

Part of the IDS Concepts and Architecture domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 1–5

1foundation · easy
What is the typical first step in the incident response process after an IDS generates an alert?
Select an answer first
2application · medium
A security analyst is reviewing flow records from a server that normally receives about 100 inbound connections per day from a small set of known IP addresses. Over the past hour, the server has received 5,000 inbound connections from thousands of different source IP addresses, all targeting the same port. The analyst wants to determine whether this is an attack or a legitimate spike. Which additional data source would be most useful to confirm the nature of the activity?
Select an answer first
3foundation · easy
In a typical network topology, where is a network-based IDS sensor most commonly placed to monitor inbound and outbound traffic?
Select an answer first
4foundation · easy
Which statement best describes how an intrusion detection system (IDS) fits into a network security architecture?
Select an answer first
5application · medium
A company wants to detect an attacker who is using a compromised web server to send spam emails. The attacker is modifying the web server's configuration files and using a legitimate email library. Which type of IDS would be most effective at detecting this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.