A SOC uses a SIEM but is missing attacks because logs from critical systems are not being ingested. The team suspects that some log sources are not sending data. What is the best way to identify and fix the issue?

Manually check each device's local logs

Increase the log retention period to ensure more data is available

Disable all alert rules until the issue is resolved

Review the SIEM's data ingestion dashboard to identify missing log sources and verify the configuration of each source

A small company with a limited security budget wants to implement continuous network monitoring. They need to detect anomalous traffic patterns and identify the source and destination of suspicious connections, but they do not need to inspect payloads. Which tool category should they prioritize?

Log management tools that only collect server logs.

Full packet capture tools to record all traffic.

Flow analysis tools (e.g., NetFlow, sFlow) to collect metadata about connections.

Intrusion detection systems with deep packet inspection.

A security team is designing a log management solution. They have a mix of on-premises and cloud-based systems. They need to ensure that logs are tamper-evident and that they can quickly search logs during incident response. Which architecture best meets these requirements?

Store logs in a local file server with no additional controls.

Use a cloud storage bucket with versioning but no search indexing.

Send logs to a SIEM but do not enable any integrity features.

Forward logs to a cloud-based SIEM with write-once-read-many (WORM) storage and indexed search.

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 2)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 6–10

6expert · hard
A SOC uses a SIEM but is missing attacks because logs from critical systems are not being ingested. The team suspects that some log sources are not sending data. What is the best way to identify and fix the issue?
Select an answer first
7foundation · easy
A security analyst is building a continuous monitoring capability and needs to select tools that will provide visibility into network traffic patterns, detect malicious activity, and support incident response. Which category of tool is specifically designed to capture and store raw network packets for later forensic analysis?
Select an answer first
8application · medium
A small company with a limited security budget wants to implement continuous network monitoring. They need to detect anomalous traffic patterns and identify the source and destination of suspicious connections, but they do not need to inspect payloads. Which tool category should they prioritize?
Select an answer first
9expert · hard
A security team is designing a log management solution. They have a mix of on-premises and cloud-based systems. They need to ensure that logs are tamper-evident and that they can quickly search logs during incident response. Which architecture best meets these requirements?
Select an answer first
10foundation · easy
Which of the following is a common log format used by network devices and applications for log management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Network Security Monitoring Tools GMON Practice Questions (Page 2)

Questions 6–10

A SOC uses a SIEM but is missing attacks because logs from critical systems are not being ingested. The team suspects that some log sources are not sending data. What is the best way to identify and fix the issue?

A small company with a limited security budget wants to implement continuous network monitoring. They need to detect anomalous traffic patterns and identify the source and destination of suspicious connections, but they do not need to inspect payloads. Which tool category should they prioritize?

A security team is designing a log management solution. They have a mix of on-premises and cloud-based systems. They need to ensure that logs are tamper-evident and that they can quickly search logs during incident response. Which architecture best meets these requirements?

Which of the following is a common log format used by network devices and applications for log management?

Keep studying — Network Monitoring and Protection