An organization wants to monitor network traffic to identify unusual patterns that might indicate a data breach. Which type of monitoring is most aligned with this goal?

Latency monitoring for application response

Anomaly detection as part of security monitoring

Error rate monitoring on network interfaces

Performance monitoring of link utilization

When analyzing network monitoring data, which pattern is most indicative of a potential distributed denial-of-service (DDoS) attack?

A sudden, massive increase in inbound traffic from many different source IP addresses

A decrease in error rates on network interfaces

A consistent pattern of small amounts of traffic at regular intervals

A gradual increase in bandwidth utilization over several months

A compliance requirement states that the organization must detect and report unauthorized access attempts. The manager needs to implement a monitoring solution. Which approach best meets this requirement?

Deploy a configuration management tool to track device settings

Deploy an intrusion detection system (IDS) and configure alerts for suspicious activity

Deploy a network performance monitor to track bandwidth usage

Deploy a packet analyzer to capture all traffic for manual review

A security manager is designing an alerting strategy. The organization has a small security team and experiences a high volume of alerts, many of which are false positives. The team is becoming desensitized to alerts. The manager needs to improve the effectiveness of alerting without missing real incidents. What is the best approach?

Assign a single person to review all alerts

Increase the severity threshold for all alerts

Implement alert correlation and tuning to reduce false positives while maintaining coverage

Disable all alerts that have a high false-positive rate

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 3)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 11–15

11foundation · easy
An organization wants to monitor network traffic to identify unusual patterns that might indicate a data breach. Which type of monitoring is most aligned with this goal?
Select an answer first
12application · medium
A manager needs to monitor network performance and detect potential bottlenecks. The organization has a mix of legacy and modern network devices. Which combination of monitoring technologies would provide the most comprehensive view?
Select an answer first
13foundation · easy
When analyzing network monitoring data, which pattern is most indicative of a potential distributed denial-of-service (DDoS) attack?
Select an answer first
14application · medium
A compliance requirement states that the organization must detect and report unauthorized access attempts. The manager needs to implement a monitoring solution. Which approach best meets this requirement?
Select an answer first
15expert · hard
A security manager is designing an alerting strategy. The organization has a small security team and experiences a high volume of alerts, many of which are false positives. The team is becoming desensitized to alerts. The manager needs to improve the effectiveness of alerting without missing real incidents. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Network Monitoring for Managers GSLC Practice Questions (Page 3)

Questions 11–15

An organization wants to monitor network traffic to identify unusual patterns that might indicate a data breach. Which type of monitoring is most aligned with this goal?

A manager needs to monitor network performance and detect potential bottlenecks. The organization has a mix of legacy and modern network devices. Which combination of monitoring technologies would provide the most comprehensive view?

When analyzing network monitoring data, which pattern is most indicative of a potential distributed denial-of-service (DDoS) attack?

A compliance requirement states that the organization must detect and report unauthorized access attempts. The manager needs to implement a monitoring solution. Which approach best meets this requirement?

Keep studying — Security Operations and Incident Management