A security team needs to deploy a device that can not only detect malicious traffic but also actively block it in real time by dropping packets. Which type of device is specifically designed to perform this inline prevention function?

Network tap with packet capture

Network Intrusion Detection System (NIDS)

Next-Generation Firewall (NGFW) without IPS

Network Intrusion Prevention System (NIPS)

A NIPS is deployed inline at the internet edge and is experiencing high CPU usage, causing latency. The security team wants to reduce CPU load while maintaining the ability to block critical threats. The NIPS has many signatures enabled, including some that are rarely triggered. Which tuning action is most effective?

Move the NIPS to passive mode to reduce CPU usage.

Increase the logging verbosity to capture more details for analysis.

Disable signatures that have not triggered in the past 90 days and are not required by compliance.

Enable all signatures to ensure comprehensive coverage.

A security analyst notices that the NIDS generates many alerts for a specific application that uses non-standard protocol framing. The alerts are all false positives. Which tuning approach is most appropriate to reduce the noise while retaining detection of real threats?

Disable the signature that matches the non-standard framing and rely on anomaly detection for that application.

Increase the sensitivity of all signatures to catch more potential threats.

Place the NIDS in inline mode to block the application's traffic.

Suppress all alerts from that application's IP addresses.

A security administrator is configuring a NIPS for a high-throughput data center network. The administrator wants to minimize latency while still blocking known critical threats. Which rule configuration approach best achieves this?

Disable all signatures and use only anomaly-based detection to reduce false positives.

Enable all signatures and set the device to alert-only mode to avoid latency.

Enable only critical signatures that are known to be reliable and place them early in the rule order.

Enable all signatures in prevention mode and rely on hardware acceleration.

A small business wants to protect its internet edge with a device that can block known exploits, allow or deny specific cloud applications, and identify users by Active Directory login. Which single device type meets all these needs?

Network intrusion detection system with alerting only.

Traditional stateful firewall with VPN support.

Next-generation firewall with integrated IPS and user identity integration.

Network intrusion prevention system with signature-based blocking.

GIAC Continuous Monitoring Certification

Domain 2Objective 2

NGFW GMON Practice Questions (Page 4)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 16–20

16foundation · easy
A security team needs to deploy a device that can not only detect malicious traffic but also actively block it in real time by dropping packets. Which type of device is specifically designed to perform this inline prevention function?
Select an answer first
17expert · hard
A NIPS is deployed inline at the internet edge and is experiencing high CPU usage, causing latency. The security team wants to reduce CPU load while maintaining the ability to block critical threats. The NIPS has many signatures enabled, including some that are rarely triggered. Which tuning action is most effective?
Select an answer first
18application · medium
A security analyst notices that the NIDS generates many alerts for a specific application that uses non-standard protocol framing. The alerts are all false positives. Which tuning approach is most appropriate to reduce the noise while retaining detection of real threats?
Select an answer first
19application · medium
A security administrator is configuring a NIPS for a high-throughput data center network. The administrator wants to minimize latency while still blocking known critical threats. Which rule configuration approach best achieves this?
Select an answer first
20application · medium
A small business wants to protect its internet edge with a device that can block known exploits, allow or deny specific cloud applications, and identify users by Active Directory login. Which single device type meets all these needs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.