A SOC is configuring alerting for a new SIEM deployment. They have a 24/7 SOC with a small team. They want to ensure that critical alerts are responded to quickly, but they also want to avoid alert fatigue. Which alerting strategy should they implement?

Disable all alerting and rely on daily reports.

Send all alerts to email and let analysts check periodically.

Page on-call analysts for every alert.

Implement tiered alerting: page on-call analysts for critical alerts, and send email for lower-priority alerts.

An analyst needs to capture traffic on a high-throughput link to investigate a possible breach. The capture must not drop packets and must be able to store several hours of data. What should the analyst do?

Use a SPAN port on the switch and capture with a laptop

Capture only the first 64 bytes of each packet to save space

Run Wireshark on a standard workstation with a 1 Gbps NIC

Use a dedicated capture appliance with a large disk array and a capture tool like tcpdump or dumpcap

A network team uses NetFlow for traffic monitoring. They notice a large amount of traffic to a known malicious IP but cannot determine if the traffic is encrypted or what application is being used. They need to confirm the threat. What should they do?

Block the IP address immediately based on the threat intelligence feed

Query the SIEM for logs from the internal host

Enable full packet capture on the relevant segment and analyze the payload to identify the application and encryption status

Use NetFlow's application recognition feature to identify the application

A security team is integrating threat intelligence feeds into their SIEM. They have two feeds: one is a free feed with a high volume of indicators and a high false-positive rate, and the other is a commercial feed with fewer indicators but higher fidelity. The team has limited analyst time. Which integration strategy is most effective?

Use only the free feed to save costs.

Use only the commercial feed and discard the free feed.

Integrate both feeds for automated alerting to maximize coverage.

Integrate the commercial feed for automated alerting and use the free feed for threat hunting only.

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 6)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 26–30

26expert · hard
A SOC is configuring alerting for a new SIEM deployment. They have a 24/7 SOC with a small team. They want to ensure that critical alerts are responded to quickly, but they also want to avoid alert fatigue. Which alerting strategy should they implement?
Select an answer first
27foundation · easy
Which of the following is a common method for delivering security alerts from a monitoring tool?
Select an answer first
28application · medium
An analyst needs to capture traffic on a high-throughput link to investigate a possible breach. The capture must not drop packets and must be able to store several hours of data. What should the analyst do?
Select an answer first
29expert · hard
A network team uses NetFlow for traffic monitoring. They notice a large amount of traffic to a known malicious IP but cannot determine if the traffic is encrypted or what application is being used. They need to confirm the threat. What should they do?
Select an answer first
30expert · hard
A security team is integrating threat intelligence feeds into their SIEM. They have two feeds: one is a free feed with a high volume of indicators and a high false-positive rate, and the other is a commercial feed with fewer indicators but higher fidelity. The team has limited analyst time. Which integration strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Network Security Monitoring Tools GMON Practice Questions (Page 6)

Questions 26–30

A SOC is configuring alerting for a new SIEM deployment. They have a 24/7 SOC with a small team. They want to ensure that critical alerts are responded to quickly, but they also want to avoid alert fatigue. Which alerting strategy should they implement?

Which of the following is a common method for delivering security alerts from a monitoring tool?

An analyst needs to capture traffic on a high-throughput link to investigate a possible breach. The capture must not drop packets and must be able to store several hours of data. What should the analyst do?

A network team uses NetFlow for traffic monitoring. They notice a large amount of traffic to a known malicious IP but cannot determine if the traffic is encrypted or what application is being used. They need to confirm the threat. What should they do?

Keep studying — Network Monitoring and Protection