A network monitoring report shows that packet loss on a critical link has increased from 0.1% to 2% over the past week, while latency remains stable. The link is not congested. The manager must decide whether to escalate this to incident response or treat it as a performance issue. What is the best decision?

Ignore it because latency is stable

Reboot the router to clear the issue

Treat it as a performance issue and have the network team investigate the physical layer

Escalate to incident response as a potential security incident

A manager notices that the performance monitoring system flags a server as 'degraded' due to high latency, but the security monitoring system shows no anomalies. The server is critical to a business application. The operations team wants to reboot the server, but the security team wants to investigate first. What should the manager do?

Correlate the latency data with security logs and recent changes before deciding

Ignore the performance alert because security shows no anomalies

Escalate to senior management for a decision

Reboot the server immediately to restore service

Which network monitoring technology is primarily used to collect and organize device status information such as CPU usage, memory, and interface status from network devices?

SNMP (Simple Network Management Protocol)

Which of the following is the primary focus of security-focused network monitoring as opposed to performance monitoring?

Detecting unauthorized access attempts and malicious activity

Optimizing application response times

Ensuring network devices are not overloaded

Measuring bandwidth utilization and latency

A network monitoring dashboard shows a sudden spike in traffic to a server that typically has low activity. The spike occurs at 3:00 AM and lasts for 30 minutes. The server is not scheduled for any maintenance. What should the manager do first?

Ignore the spike because it is outside business hours

Investigate the cause of the spike

Reboot the server to clear any temporary issue

Increase the server's bandwidth limit

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 10)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 46–50

46expert · hard
A network monitoring report shows that packet loss on a critical link has increased from 0.1% to 2% over the past week, while latency remains stable. The link is not congested. The manager must decide whether to escalate this to incident response or treat it as a performance issue. What is the best decision?
Select an answer first
47expert · hard
A manager notices that the performance monitoring system flags a server as 'degraded' due to high latency, but the security monitoring system shows no anomalies. The server is critical to a business application. The operations team wants to reboot the server, but the security team wants to investigate first. What should the manager do?
Select an answer first
48foundation · easy
Which network monitoring technology is primarily used to collect and organize device status information such as CPU usage, memory, and interface status from network devices?
Select an answer first
49foundation · easy
Which of the following is the primary focus of security-focused network monitoring as opposed to performance monitoring?
Select an answer first
50application · medium
A network monitoring dashboard shows a sudden spike in traffic to a server that typically has low activity. The spike occurs at 3:00 AM and lasts for 30 minutes. The server is not scheduled for any maintenance. What should the manager do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Network Monitoring for Managers GSLC Practice Questions (Page 10)

Questions 46–50

Which network monitoring technology is primarily used to collect and organize device status information such as CPU usage, memory, and interface status from network devices?

Which of the following is the primary focus of security-focused network monitoring as opposed to performance monitoring?

A network monitoring dashboard shows a sudden spike in traffic to a server that typically has low activity. The spike occurs at 3:00 AM and lasts for 30 minutes. The server is not scheduled for any maintenance. What should the manager do first?

Keep studying — Security Operations and Incident Management