A SOC uses a SIEM to monitor security events. They are overwhelmed by low-priority alerts and have missed a critical incident. The SIEM receives logs from firewalls, endpoints, and authentication systems. They want to improve detection without adding more staff. What is the most effective action?

Increase the log retention period to 18 months

Implement correlation rules that combine events from multiple sources and assign risk scores, then create alerting rules for high-risk scores

Disable all low-priority alert rules

Forward all alerts to a ticketing system for manual review

A security operations team wants to detect large-scale data transfers from internal hosts to external IP addresses that are not typical for the organization. They have limited storage and cannot store full packet captures for more than a few hours. Which tool and data source combination would best meet this requirement?

NetFlow collector with thresholds on bytes transferred per flow, enriched with threat intelligence for external IPs.

SIEM with only Windows Event Logs from endpoints.

IDS with signature-based alerts for known malware signatures.

Full packet capture appliance with 100% retention for 30 days.

A company has deployed an inline IPS at the internet perimeter. The security team is concerned about false positives blocking legitimate business traffic. They want to maintain detection capability while minimizing disruption. Which configuration approach should they use?

Disable the IPS and rely on the firewall for all security.

Enable blocking for all rules immediately to maximize security.

Set the IPS to alert-only mode for all rules, then review alerts and gradually enable blocking for high-confidence rules.

Use a passive IDS instead of an inline IPS to avoid any blocking.

What is the primary purpose of a log management tool?

To capture raw network packets for forensic analysis

To collect, store, and analyze log data from various systems and applications

To scan systems for vulnerabilities

To block malicious traffic at the network perimeter

A company needs to retain firewall logs for at least one year to meet compliance requirements. They also want to enable rapid searching for incident investigations. Which solution should they choose?

Compress logs and store them on a network share without indexing

Store logs on the firewall's local disk for one year

Ship logs to a centralized log management platform with indexed search and long-term storage

Email logs daily to a shared mailbox

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 7)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 31–35

31expert · hard
A SOC uses a SIEM to monitor security events. They are overwhelmed by low-priority alerts and have missed a critical incident. The SIEM receives logs from firewalls, endpoints, and authentication systems. They want to improve detection without adding more staff. What is the most effective action?
Select an answer first
32application · medium
A security operations team wants to detect large-scale data transfers from internal hosts to external IP addresses that are not typical for the organization. They have limited storage and cannot store full packet captures for more than a few hours. Which tool and data source combination would best meet this requirement?
Select an answer first
33application · medium
A company has deployed an inline IPS at the internet perimeter. The security team is concerned about false positives blocking legitimate business traffic. They want to maintain detection capability while minimizing disruption. Which configuration approach should they use?
Select an answer first
34foundation · easy
What is the primary purpose of a log management tool?
Select an answer first
35application · medium
A company needs to retain firewall logs for at least one year to meet compliance requirements. They also want to enable rapid searching for incident investigations. Which solution should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.