Which rule-ordering practice is a best practice for NIDS/NIPS/NGFW policy configuration to balance security and performance?

Place the most specific rules at the bottom to ensure they are evaluated last

Use as many rules as possible to ensure comprehensive coverage

Randomize rule order to distribute processing load evenly

Place the most frequently matched rules at the top of the rule base

An analyst notices that a NIDS fails to detect a known malware signature when the payload is split across multiple TCP segments. The NIDS is configured to reassemble TCP streams. What is the most likely reason for the missed detection?

The NIDS is in passive mode and cannot inspect segmented traffic.

The NIDS is dropping packets due to high throughput.

The NIDS is not reassembling the TCP stream correctly due to overlapping segments.

The signature is too new and not yet in the signature database.

A company wants to allow employees to use personal webmail but block the upload of sensitive files to personal cloud storage. The NGFW is configured with SSL decryption. What is the most effective policy?

Create application-based rules that allow webmail but block cloud-storage applications, and use data filtering to block uploads of sensitive file types.

Block all HTTPS traffic to prevent any data exfiltration.

Use user identification to block specific users from using cloud storage.

Enable signature-based IPS to block known malware uploads.

A security analyst notices that a NIDS has generated thousands of alerts for a known exploit signature, but the alerts are all triggered by a single internal host that is not vulnerable to that exploit. The analyst wants to reduce noise while still detecting the exploit if it targets a vulnerable host. Which action is most appropriate?

Disable the signature globally to reduce alert fatigue.

Create a suppression rule that filters alerts from the non-vulnerable host while keeping the signature enabled.

Increase the alert threshold for all hosts to reduce the number of alerts.

Switch the NIDS to anomaly-based detection to avoid signature noise.

A company wants to replace its legacy stateful firewall with a device that can enforce policies based on the actual application (e.g., allow Facebook but block Facebook video) and identify users regardless of IP address. Which technology provides these capabilities?

Traditional stateful firewall with port-based rules.

Network intrusion prevention system with signature-based blocking only.

Next-generation firewall with application identification and user identity integration.

Network intrusion detection system in passive mode.

GIAC Continuous Monitoring Certification

Domain 2Objective 2

NGFW GMON Practice Questions (Page 8)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 36–40

36foundation · easy
Which rule-ordering practice is a best practice for NIDS/NIPS/NGFW policy configuration to balance security and performance?
Select an answer first
37application · medium
An analyst notices that a NIDS fails to detect a known malware signature when the payload is split across multiple TCP segments. The NIDS is configured to reassemble TCP streams. What is the most likely reason for the missed detection?
Select an answer first
38expert · hard
A company wants to allow employees to use personal webmail but block the upload of sensitive files to personal cloud storage. The NGFW is configured with SSL decryption. What is the most effective policy?
Select an answer first
39application · medium
A security analyst notices that a NIDS has generated thousands of alerts for a known exploit signature, but the alerts are all triggered by a single internal host that is not vulnerable to that exploit. The analyst wants to reduce noise while still detecting the exploit if it targets a vulnerable host. Which action is most appropriate?
Select an answer first
40application · medium
A company wants to replace its legacy stateful firewall with a device that can enforce policies based on the actual application (e.g., allow Facebook but block Facebook video) and identify users regardless of IP address. Which technology provides these capabilities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.