An organization has a network-based IDS that generates many false positives. The security team wants to reduce noise while still detecting real threats. They have a threat intelligence feed of known malicious IPs. What should they configure?

Disable all IDS signatures and rely solely on the threat intelligence feed

Forward all IDS alerts to the SIEM without filtering

Add the threat intelligence IPs to a watchlist and create a custom signature that alerts only when traffic matches those IPs

Increase the sensitivity of all signatures to catch more traffic

A small company with limited budget wants to start continuous monitoring of their network. They need to detect anomalies in traffic patterns and identify potential malware communications. They cannot afford a commercial SIEM. What is the most cost-effective approach?

Purchase a commercial SIEM with all features

Use manual packet capture on critical servers only

Deploy open-source flow analysis tools like Zeek and a lightweight log aggregator

Rely solely on firewall logs without any analysis

GIAC Continuous Monitoring Certification

Domain 2Objective 1

Network Security Monitoring Tools GMON Practice Questions (Page 9)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 41–45

41application · medium
An organization has a network-based IDS that generates many false positives. The security team wants to reduce noise while still detecting real threats. They have a threat intelligence feed of known malicious IPs. What should they configure?
Select an answer first
42foundation · easy
Which SIEM capability allows an analyst to identify a multi-step attack by examining related events across different systems?
Select an answer first
43foundation · easy
Which of the following is an example of a threat intelligence indicator that can be integrated into a monitoring tool?
Select an answer first
44application · medium
A small company with limited budget wants to start continuous monitoring of their network. They need to detect anomalies in traffic patterns and identify potential malware communications. They cannot afford a commercial SIEM. What is the most cost-effective approach?
Select an answer first
45foundation · easy
Which packet capture tool provides a graphical user interface for deep inspection of captured network traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Network Security Monitoring Tools GMON Practice Questions (Page 9)

Questions 41–45

An organization has a network-based IDS that generates many false positives. The security team wants to reduce noise while still detecting real threats. They have a threat intelligence feed of known malicious IPs. What should they configure?

Which SIEM capability allows an analyst to identify a multi-step attack by examining related events across different systems?

Which of the following is an example of a threat intelligence indicator that can be integrated into a monitoring tool?

A small company with limited budget wants to start continuous monitoring of their network. They need to detect anomalies in traffic patterns and identify potential malware communications. They cannot afford a commercial SIEM. What is the most cost-effective approach?

Which packet capture tool provides a graphical user interface for deep inspection of captured network traffic?

Keep studying — Network Monitoring and Protection