Which capability is a defining feature of a Next-Generation Firewall (NGFW) that distinguishes it from a traditional stateful firewall?

Network address translation (NAT)

Virtual LAN (VLAN) trunking support

Application awareness and control

An analyst reviews NGFW logs and sees a high volume of alerts for outbound connections to a known malware domain, but the source IPs are all internal web servers. The alerts are triggered by a signature that matches a string in the HTTP response. What is the most likely explanation?

The web servers are using a proxy that caches malicious content.

The NGFW is configured to block all outbound traffic to that domain.

The signature is matching benign content in the responses, causing false positives.

The web servers are compromised and beaconing to the malware domain.

An attacker is using a polymorphic malware that changes its signature each time it spreads. The NIDS has signature-based detection enabled but is missing the malware. Which additional detection method would be most effective?

Disable anomaly detection to reduce false positives.

Use only port-based rules to block the malware's communication.

Enable behavioral detection to identify the malware's actions rather than its signature.

Update the signature database more frequently.

A security operations center is evaluating a NIDS that uses both signature-based and anomaly-based detection. The NIDS has generated a high number of alerts, many of which are false positives. The team wants to reduce false positives without missing true positives. Which approach is most effective?

Tune the anomaly-based detection thresholds based on a longer baseline of normal traffic.

Set all signatures to alert-only mode to avoid blocking legitimate traffic.

Disable anomaly-based detection and rely only on signature-based detection.

Increase the logging verbosity to capture more data for analysis.

GIAC Continuous Monitoring Certification

Domain 2Objective 2

NGFW GMON Practice Questions (Page 3)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
Which capability is a defining feature of a Next-Generation Firewall (NGFW) that distinguishes it from a traditional stateful firewall?
Select an answer first
12foundation · easy
An attacker fragments a malicious payload across multiple small IP packets to avoid detection by a NIDS. Which evasion technique is being used?
Select an answer first
13application · medium
An analyst reviews NGFW logs and sees a high volume of alerts for outbound connections to a known malware domain, but the source IPs are all internal web servers. The alerts are triggered by a signature that matches a string in the HTTP response. What is the most likely explanation?
Select an answer first
14expert · hard
An attacker is using a polymorphic malware that changes its signature each time it spreads. The NIDS has signature-based detection enabled but is missing the malware. Which additional detection method would be most effective?
Select an answer first
15expert · hard
A security operations center is evaluating a NIDS that uses both signature-based and anomaly-based detection. The NIDS has generated a high number of alerts, many of which are false positives. The team wants to reduce false positives without missing true positives. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.