A security operations center (SOC) receives alerts from multiple sources: firewall logs, antivirus alerts, and authentication logs. Analysts are overwhelmed and missing critical incidents. What should the SOC implement to improve detection and response?

Increase the number of analysts to manually review all alerts

Disable alerts from the least critical sources

Store all logs in a central file server for manual search

Deploy a SIEM to aggregate and correlate events from all sources

A SOC manager is evaluating SIEM solutions. The organization has a strict budget and cannot afford a commercial SIEM. They have a small team with limited scripting skills. They need to collect logs from diverse sources, correlate events, and generate alerts. Which approach is most practical?

Use a simple log aggregation tool without correlation capabilities.

Build a custom correlation engine from scratch using Python scripts.

Use an open-source SIEM like Elastic Stack with pre-built correlation rules and community support.

Use a commercial SIEM with a free tier that limits data volume.

Which of the following is a common signature-based detection technique used by IDS/IPS systems?

Using machine learning to classify traffic

Analyzing deviations from a baseline of normal behavior

Correlating logs from multiple sources

Matching network traffic against known attack patterns

What is the primary function of a Security Information and Event Management (SIEM) system?

Capturing raw network packets for forensic analysis

Blocking malicious traffic at the network perimeter

Aggregating and correlating security events from multiple sources to provide centralized monitoring and alerting

Scanning systems for vulnerabilities

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 11)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 51–55

51application · medium
A security operations center (SOC) receives alerts from multiple sources: firewall logs, antivirus alerts, and authentication logs. Analysts are overwhelmed and missing critical incidents. What should the SOC implement to improve detection and response?
Select an answer first
52expert · hard
A SOC manager is evaluating SIEM solutions. The organization has a strict budget and cannot afford a commercial SIEM. They have a small team with limited scripting skills. They need to collect logs from diverse sources, correlate events, and generate alerts. Which approach is most practical?
Select an answer first
53foundation · easy
Which of the following is a common signature-based detection technique used by IDS/IPS systems?
Select an answer first
54foundation · easy
What is the primary function of a Security Information and Event Management (SIEM) system?
Select an answer first
55foundation · easy
Which technology is commonly used to collect network flow data for traffic analysis and anomaly detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.