A NIDS generates an alert for a signature that matches a known web application attack. The analyst reviews the alert and sees that the source IP is an internal scanner that the security team uses for vulnerability assessments. The scanner is scheduled to run during this time. What should the analyst do first?

Treat the alert as a false positive and close it without further action

Verify the alert against the scanner's schedule and correlate with other logs

Disable the signature that triggered the alert

Immediately block the scanner's IP address at the firewall

A company has a flat network with no internal segmentation. All servers and workstations are on the same VLAN. The security team wants to deploy a single NIDS sensor to monitor all internal traffic. What is the most effective way to get traffic to the sensor?

Configure a SPAN port on the switch to mirror all VLAN traffic to the sensor

Use NetFlow export from the switch to the sensor

Install the sensor on a server and enable promiscuous mode

Place the sensor inline between the switch and the router

An analyst is investigating a possible data exfiltration. The NIDS did not alert, but the analyst has access to NetFlow records. Which type of analysis is most appropriate using NetFlow data?

Run a signature-based scan against the flow records

Look for large outbound transfers to a single external IP that are unusual compared to the baseline

Inspect the full packet payloads of all outbound connections

Use the flow records to reconstruct the content of the exfiltrated files

An analyst is investigating a suspected slow data exfiltration that has been occurring over several weeks. The NIDS has not generated any alerts because the traffic volumes are within normal baseline. The analyst suspects that data is being sent in small, encrypted chunks to a cloud storage service. Which data source would be most useful to detect this activity?

Firewall logs showing only allowed connections

Long-term flow records that can be analyzed for cumulative volume and destination patterns

Real-time full packet capture of all traffic

GIAC Certified Intrusion Analyst

Domain 3Objective 1

IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 3)

Part of the IDS Concepts and Architecture domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 11–15

11application · medium
A NIDS generates an alert for a signature that matches a known web application attack. The analyst reviews the alert and sees that the source IP is an internal scanner that the security team uses for vulnerability assessments. The scanner is scheduled to run during this time. What should the analyst do first?
Select an answer first
12application · medium
A company has a flat network with no internal segmentation. All servers and workstations are on the same VLAN. The security team wants to deploy a single NIDS sensor to monitor all internal traffic. What is the most effective way to get traffic to the sensor?
Select an answer first
13application · medium
An analyst is investigating a possible data exfiltration. The NIDS did not alert, but the analyst has access to NetFlow records. Which type of analysis is most appropriate using NetFlow data?
Select an answer first
14expert · hard
An analyst is investigating a suspected slow data exfiltration that has been occurring over several weeks. The NIDS has not generated any alerts because the traffic volumes are within normal baseline. The analyst suspects that data is being sent in small, encrypted chunks to a cloud storage service. Which data source would be most useful to detect this activity?
Select an answer first
15foundation · easy
Which component of an IDS is responsible for notifying analysts when a suspicious event is detected?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 3)

Questions 11–15

A company has a flat network with no internal segmentation. All servers and workstations are on the same VLAN. The security team wants to deploy a single NIDS sensor to monitor all internal traffic. What is the most effective way to get traffic to the sensor?

An analyst is investigating a possible data exfiltration. The NIDS did not alert, but the analyst has access to NetFlow records. Which type of analysis is most appropriate using NetFlow data?

Which component of an IDS is responsible for notifying analysts when a suspicious event is detected?

Keep studying — IDS Concepts and Architecture