When creating a rule in an NGFW to block a specific application, which additional parameter is most important to include to avoid unintentionally blocking other applications that use the same port?

Application signature or application ID

Source and destination IP addresses

An attacker is sending fragmented IP packets to evade a network-based IDS. The IDS is configured to reassemble fragments before inspection. Which countermeasure is most effective?

Place the IDS in inline mode but keep reassembly disabled.

Disable fragment reassembly to reduce processing overhead.

Use only signature-based detection without reassembly.

Enable fragment reassembly on the IDS and configure the firewall to drop overlapping fragments.

A NIPS is generating a high volume of false positives because a legitimate application uses non-standard port numbers and unusual packet sizes. The security team wants to reduce false positives without losing detection of actual malicious activity. Which tuning strategy is most appropriate?

Set the NIPS to alert-only mode for all traffic.

Increase the sensitivity of all signatures to catch more threats.

Create an allowlist rule for the application's traffic patterns and apply it before other rules.

Disable all signatures that trigger on the application's traffic.

GIAC Continuous Monitoring Certification

Domain 2Objective 2

NGFW GMON Practice Questions (Page 1)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
When creating a rule in an NGFW to block a specific application, which additional parameter is most important to include to avoid unintentionally blocking other applications that use the same port?
Select an answer first
2application · medium
An attacker is sending fragmented IP packets to evade a network-based IDS. The IDS is configured to reassemble fragments before inspection. Which countermeasure is most effective?
Select an answer first
3application · medium
A NIPS is generating a high volume of false positives because a legitimate application uses non-standard port numbers and unusual packet sizes. The security team wants to reduce false positives without losing detection of actual malicious activity. Which tuning strategy is most appropriate?
Select an answer first
4foundation · easy
A network security analyst notices that a NIDS is generating alerts for traffic that matches a known malware signature. Which detection method is the NIDS using?
Select an answer first
5foundation · easy
A security architect wants to deploy a network monitoring device that can inspect traffic without introducing a point of failure in the network path. Which deployment mode should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

NIDS/NIPS/NGFW GMON Practice Questions (Page 1)

Questions 1–5

When creating a rule in an NGFW to block a specific application, which additional parameter is most important to include to avoid unintentionally blocking other applications that use the same port?

An attacker is sending fragmented IP packets to evade a network-based IDS. The IDS is configured to reassemble fragments before inspection. Which countermeasure is most effective?

A NIPS is generating a high volume of false positives because a legitimate application uses non-standard port numbers and unusual packet sizes. The security team wants to reduce false positives without losing detection of actual malicious activity. Which tuning strategy is most appropriate?

A network security analyst notices that a NIDS is generating alerts for traffic that matches a known malware signature. Which detection method is the NIDS using?

A security architect wants to deploy a network monitoring device that can inspect traffic without introducing a point of failure in the network path. Which deployment mode should be used?

Keep studying — Network Monitoring and Protection