An organization wants to improve its detection of emerging threats by incorporating external threat intelligence feeds into its security monitoring. They have a SIEM and an IDS. Which integration approach would provide the most immediate benefit?

Import threat intelligence indicators (IOCs) into the SIEM and create correlation rules to alert on matches.

Subscribe to a threat intelligence feed but do not configure any alerts.

Manually review threat intelligence reports on a weekly basis.

Use threat intelligence only for threat hunting, not for automated detection.

What type of data does a flow analysis tool typically collect and analyze?

System logs from servers and applications

Full packet payloads for deep inspection

Metadata about network conversations, such as source and destination IPs, ports, and byte counts

A security operations center (SOC) is overwhelmed with alerts, many of which are false positives. The team wants to reduce alert fatigue while ensuring that critical alerts are not missed. Which strategy should they implement?

Send all alerts to email and let analysts triage manually.

Disable all alerts that have generated false positives in the past.

Tune detection rules to reduce false positives and implement alert prioritization based on risk.

Increase the severity level of all alerts to ensure they are noticed.

A security manager is planning a network monitoring architecture for a new branch office. The office has a small IT staff and a limited budget. The manager needs to detect network intrusions and anomalies, but also needs to minimize the number of tools to manage. Which approach is most appropriate?

Use open-source tools but do not integrate them.

Deploy a next-generation firewall (NGFW) with integrated IDS/IPS and flow analysis capabilities.

Use only a SIEM to collect logs and no network monitoring.

Deploy separate IDS, flow collector, and packet capture tools.

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 5)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 21–25

21application · medium
An organization wants to improve its detection of emerging threats by incorporating external threat intelligence feeds into its security monitoring. They have a SIEM and an IDS. Which integration approach would provide the most immediate benefit?
Select an answer first
22foundation · easy
A security analyst needs to capture network traffic on a Linux interface for later analysis. Which command-line tool is commonly used for this purpose?
Select an answer first
23foundation · easy
What type of data does a flow analysis tool typically collect and analyze?
Select an answer first
24application · medium
A security operations center (SOC) is overwhelmed with alerts, many of which are false positives. The team wants to reduce alert fatigue while ensuring that critical alerts are not missed. Which strategy should they implement?
Select an answer first
25expert · hard
A security manager is planning a network monitoring architecture for a new branch office. The office has a small IT staff and a limited budget. The manager needs to detect network intrusions and anomalies, but also needs to minimize the number of tools to manage. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.