A network manager notices that a server's outbound traffic has increased significantly over the past week, but the server's role does not require such traffic. The manager also sees that the server is communicating with an IP address in a foreign country. What is the most likely interpretation?

The server may be compromised and participating in data exfiltration

The server is experiencing a performance issue

The server is being used for peer-to-peer file sharing

The server is performing a legitimate backup

A manager is reviewing the alert queue and sees 500 alerts per day, mostly false positives from a new IDS rule. The security team is overwhelmed and has started ignoring alerts. The manager needs to improve the situation without missing real incidents. What is the best course of action?

Disable the new IDS rule entirely

Tune the IDS rules to reduce false positives and establish a tiered alert triage process

Increase the number of security analysts

Escalate every alert to the incident response team

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 11)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 51–52

51application · medium
A network manager notices that a server's outbound traffic has increased significantly over the past week, but the server's role does not require such traffic. The manager also sees that the server is communicating with an IP address in a foreign country. What is the most likely interpretation?
Select an answer first
52expert · hard
A manager is reviewing the alert queue and sees 500 alerts per day, mostly false positives from a new IDS rule. The security team is overwhelmed and has started ignoring alerts. The manager needs to improve the situation without missing real incidents. What is the best course of action?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Network Monitoring for Managers GSLC Practice Questions (Page 11)

Questions 51–52

A network manager notices that a server's outbound traffic has increased significantly over the past week, but the server's role does not require such traffic. The manager also sees that the server is communicating with an IP address in a foreign country. What is the most likely interpretation?

A manager is reviewing the alert queue and sees 500 alerts per day, mostly false positives from a new IDS rule. The security team is overwhelmed and has started ignoring alerts. The manager needs to improve the situation without missing real incidents. What is the best course of action?

Keep studying — Security Operations and Incident Management