Network Security Monitoring Tools GMON Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC wants to ensure that critical security alerts are not missed during off-hours. They have a SIEM that can send notifications. What should they configure?

   • ASend all alerts to a distribution list without prioritization
   • BSet up email and SMS alerts for high-priority events, with an escalation policy to on-call staff
   • COnly log alerts in the SIEM dashboard for review the next morning
   • DConfigure the SIEM to automatically suppress alerts during off-hours
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An analyst is investigating a network anomaly. Flow data shows a sudden increase in traffic to a specific external IP, but the flow data does not show the content. The analyst suspects the traffic may be encrypted, but they need to determine if any sensitive data is being transmitted. Which approach should they take?

   • ADecrypt the TLS traffic using a man-in-the-middle proxy.
   • BCapture packets and inspect the TLS handshake to identify the application, then use application logs to determine what data is being sent.
   • CUse flow data to determine the data content.
   • DBlock the external IP immediately.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has an inline IPS that blocks malicious traffic. However, the IPS has blocked a legitimate business application, causing downtime. The security team wants to maintain protection while reducing false positives. They have a SIEM and threat intelligence. What is the best approach?

   • APlace the IPS in monitor mode for the affected application, create a custom rule to alert on the specific traffic, and tune the rule based on SIEM correlation with threat intelligence
   • BAdd an exception for the application's IP addresses in the IPS
   • CIncrease the IPS sensitivity to catch more threats
   • DDisable the IPS entirely to avoid further downtime
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An organization uses a SIEM and an IDS. They have a threat intelligence feed that provides indicators of compromise (IOCs). They want to automatically block malicious IPs at the firewall. The firewall does not have an API for dynamic updates. What is the best approach?

   • AUse the SIEM to generate alerts for IOCs and have analysts manually update the firewall blocklist via the management interface
   • BReplace the firewall with one that supports API integration
   • CDisable the threat intelligence feed because it cannot be automated
   • DConfigure the IDS to block traffic directly
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team needs to ensure that logs from network devices, servers, and applications are collected centrally and can be searched quickly during incident response. They also want to detect unauthorized changes to log files. Which approach should they implement?

   • ASend logs to a SIEM but do not enable any integrity checks.
   • BForward all logs to a centralized log management platform with hashing and integrity monitoring.
   • CStore logs locally on each device and back them up weekly.
   • DUse a cloud storage bucket for logs with no additional monitoring.
   Reveal Solution Discussion Select an answer first