A security analyst needs to investigate a suspected data exfiltration from a web server. The analyst must reconstruct the actual payload of the HTTP requests to confirm whether sensitive data was sent. Which approach should the analyst use?

Capture full packets on the web server's interface and reassemble the TCP streams in Wireshark

Enable SNMP traps on the web server to monitor outbound traffic

Review the SIEM correlation rules for web server logs

Query the NetFlow collector for the top talkers to the external IP

A network analyst is troubleshooting a suspected data exfiltration. Flow data shows a large amount of data transferred from a database server to an external IP over a short period. However, the flow data does not indicate whether the data was encrypted or what type of data was sent. The analyst needs to confirm the exfiltration and identify the data. Which action should they take?

Check the database server's audit logs to see which queries were run.

Contact the ISP to obtain the external IP's traffic logs.

Use packet capture on the database server's network segment to capture the traffic and inspect the payloads.

Use flow data to identify the exact files transferred.

What is the primary purpose of integrating threat intelligence feeds into security monitoring tools?

To replace the need for signature-based detection

To reduce network bandwidth usage

To automate all incident response actions

To enhance detection capabilities by providing indicators of compromise and known malicious indicators

An organization has an IPS that is inline and blocking traffic. They have received a threat intelligence feed that includes IP addresses that are also used by a legitimate partner. The IPS is blocking the partner's traffic, causing business disruption. What is the best approach?

Block the partner's IPs at the firewall as well

Remove the threat intelligence feed entirely

Set the IPS to monitor mode for all traffic

Create a whitelist for the partner's IP addresses in the IPS, but continue to monitor the traffic via the SIEM and alert on any suspicious behavior

A network team wants to detect large data transfers from an internal database server to an external IP address. They need a solution that provides visibility into traffic patterns without storing full packet captures. Which tool should they deploy?

Host-based firewall logging on the database server

NetFlow collector with a threshold alert on flow bytes

DNS query logging for the external domain

Packet capture appliance storing all traffic

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 4)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 16–20

16application · medium
A security analyst needs to investigate a suspected data exfiltration from a web server. The analyst must reconstruct the actual payload of the HTTP requests to confirm whether sensitive data was sent. Which approach should the analyst use?
Select an answer first
17expert · hard
A network analyst is troubleshooting a suspected data exfiltration. Flow data shows a large amount of data transferred from a database server to an external IP over a short period. However, the flow data does not indicate whether the data was encrypted or what type of data was sent. The analyst needs to confirm the exfiltration and identify the data. Which action should they take?
Select an answer first
18foundation · easy
What is the primary purpose of integrating threat intelligence feeds into security monitoring tools?
Select an answer first
19expert · hard
An organization has an IPS that is inline and blocking traffic. They have received a threat intelligence feed that includes IP addresses that are also used by a legitimate partner. The IPS is blocking the partner's traffic, causing business disruption. What is the best approach?
Select an answer first
20application · medium
A network team wants to detect large data transfers from an internal database server to an external IP address. They need a solution that provides visibility into traffic patterns without storing full packet captures. Which tool should they deploy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.