What is the purpose of configuring alerting mechanisms in a security monitoring tool?

To automatically patch vulnerable systems

To notify security personnel of potential security events in a timely manner

To store logs for compliance purposes

A security team is deploying a SIEM and wants to detect a multi-stage attack that involves authentication failures on a domain controller, followed by lateral movement to a file server, and then data access. Which SIEM capability is most essential for this detection?

Long-term storage of raw logs for compliance.

Real-time alerting on each individual event as it occurs.

Correlation rules that link events across multiple log sources over a time window.

Dashboards showing the number of events per source.

What type of analysis does a network traffic analysis (NTA) tool typically perform to detect threats?

Vulnerability scanning of network devices

Signature matching against known malware signatures

Log aggregation from multiple sources

Behavioral analysis to identify deviations from normal traffic patterns

An analyst is investigating a potential data exfiltration. They have NetFlow data showing a large transfer to an external IP, but they need to confirm the content of the transfer. The transfer occurred 3 days ago. What is the best way to obtain the evidence?

Check if full packet capture was retained for that period and analyze the pcap for the specific flow

Use NetFlow's application recognition to determine the protocol

Query the SIEM for logs from the internal host

Contact the external IP's ISP for logs

A company needs to monitor a high-speed network segment for both real-time alerts and historical analysis. They have a limited budget and cannot afford a commercial SIEM. They need to detect anomalies and also be able to investigate past incidents. What is the best approach?

Use only NetFlow for both real-time and historical analysis

Deploy open-source tools: use Zeek for real-time flow analysis and alerting, and store full packet captures for a short period for historical analysis

Use a commercial SIEM with full packet capture

Use only full packet capture for everything

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 10)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 46–50

46foundation · easy
What is the purpose of configuring alerting mechanisms in a security monitoring tool?
Select an answer first
47application · medium
A security team is deploying a SIEM and wants to detect a multi-stage attack that involves authentication failures on a domain controller, followed by lateral movement to a file server, and then data access. Which SIEM capability is most essential for this detection?
Select an answer first
48foundation · easy
What type of analysis does a network traffic analysis (NTA) tool typically perform to detect threats?
Select an answer first
49expert · hard
An analyst is investigating a potential data exfiltration. They have NetFlow data showing a large transfer to an external IP, but they need to confirm the content of the transfer. The transfer occurred 3 days ago. What is the best way to obtain the evidence?
Select an answer first
50expert · hard
A company needs to monitor a high-speed network segment for both real-time alerts and historical analysis. They have a limited budget and cannot afford a commercial SIEM. They need to detect anomalies and also be able to investigate past incidents. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.