Network Monitoring for Managers GSLC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A compliance requirement states that 'network traffic must be monitored for unauthorized access attempts.' The organization has an IDS but does not review its alerts regularly. What is the most important gap the manager should address?

   • APurchase a more expensive IDS
   • BIncrease the number of IDS sensors
   • CDisable alerts that are not reviewed
   • DEstablish a formal alert review and escalation process
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization must comply with a regulation that requires 'continuous monitoring of network traffic and timely response to incidents.' The current monitoring system only captures NetFlow data and does not inspect payloads. The security team argues that full packet capture is required. The manager must balance compliance with cost. What is the best approach?

   • AKeep NetFlow and add targeted packet capture on critical segments, with a documented alert response procedure
   • BDiscontinue monitoring until the legal team clarifies the requirement
   • CRely solely on NetFlow and argue that it meets the requirement
   • DImplement full packet capture on all network segments
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security manager is explaining to executives why the organization invests in network monitoring. Which statement best captures the primary purpose of network monitoring from a security and operations perspective?

   • AIt replaces the need for regular security audits and vulnerability assessments.
   • BIt automatically blocks all malicious traffic before it reaches the network perimeter.
   • CIt is mainly used to enforce compliance with data protection regulations by encrypting all traffic.
   • DIt provides real-time visibility into network activity, enabling the detection of anomalies, security incidents, and performance issues that could affect business continuity.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manager reviews a weekly network report and notices that average latency between two office locations has increased from 20 ms to 60 ms, while bandwidth utilization remains below 30%. The report also shows a rising error rate on the WAN link. What is the most likely conclusion?

   • AThe increase is normal and requires no action
   • BThe link is congested because bandwidth utilization is below 30%
   • CThe firewall is blocking traffic causing retransmissions
   • DThe WAN link is experiencing a physical or configuration issue causing errors and retransmissions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network operations team uses SNMP to monitor router CPU and interface utilization. The security team wants to detect command-and-control traffic that uses non-standard ports. Which additional monitoring capability should the manager approve?

   • ASyslog collection from all network devices
   • BNetFlow analysis to identify unusual port and destination combinations
   • CExtended ping tests to all external IP addresses
   • DMore frequent SNMP polling of interface counters
   Reveal Solution Discussion Select an answer first