Network Security Monitoring Tools GMON Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company must retain logs for compliance but has limited storage. They also need to be able to search logs quickly for incident response. What is the best strategy?

   • AKeep logs only for the minimum required period and delete them immediately after
   • BStore all logs in a single compressed archive for the entire retention period
   • CStore logs on the devices that generated them
   • DUse a tiered log management solution: store recent logs in fast indexed storage and archive older logs to cheaper storage with the ability to restore on demand
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization wants to automatically block traffic from IP addresses that are known to be malicious according to a commercial threat intelligence feed. They have an existing firewall and SIEM. What is the most effective way to implement this?

   • AIntegrate the threat intelligence feed with the SIEM and use a script to push indicators to the firewall's blocklist
   • BManually add each malicious IP to the firewall blocklist as they appear in the feed
   • CConfigure the firewall to download the threat intelligence feed directly
   • DUse the SIEM to generate alerts for each malicious IP and have analysts block them
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC wants to reduce alert fatigue while ensuring critical alerts are escalated. They have a SIEM that can send alerts via email, SMS, and a ticketing system. The team works 24/7 but has limited staff. What is the best alerting strategy?

   • ASend all alerts to the ticketing system only
   • BConfigure tiered alerting: send high-priority alerts via SMS and ticketing, medium-priority via email, and low-priority to a daily digest
   • CSend all alerts via SMS to ensure nothing is missed
   • DDisable all alerting and rely on daily manual review of the SIEM dashboard
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst notices unusual traffic patterns in the network: periodic small outbound connections to a known command-and-control (C2) domain. The team wants to confirm the beaconing behavior and identify which internal hosts are involved. Which combination of tools would be most effective?

   • AUse flow analysis to identify the internal IPs and connection frequency, then use packet capture on those hosts to inspect the payloads.
   • BUse a SIEM to correlate firewall logs and endpoint logs.
   • CUse only packet capture on the internet gateway to capture all traffic.
   • DUse only NetFlow to see the connections and skip packet capture.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS uses signatures, while an IPS uses only anomaly-based detection
   • BAn IDS is a software tool, while an IPS is a hardware appliance
   • CAn IDS is deployed inline, while an IPS is deployed out-of-band
   • DAn IDS monitors and alerts on suspicious activity, while an IPS can actively block or drop malicious traffic
   Reveal Solution Discussion Select an answer first