A security analyst receives an alert for a potential malware infection on a laptop. The laptop is used by a senior executive and contains sensitive data. The incident response plan requires that the laptop be isolated immediately, but the executive is in an important client meeting and disconnecting would disrupt the presentation. What should the manager do?

Isolate the laptop immediately, as the potential malware infection poses a greater risk than the meeting disruption

Wait until the meeting ends to avoid disruption

Disconnect only the network cable but allow the laptop to continue

Ask the executive to continue but monitor the laptop closely

An IDS generates an alert for a known malware signature on a workstation. The alert is not correlated with any other suspicious activity. According to the incident response plan, low-priority alerts are reviewed within 24 hours. What should the manager do?

Ignore the alert because it is not correlated with other activity

Disable the IDS signature to reduce false positives

Immediately activate the full incident response team

Ensure the alert is logged and assigned to an analyst for review within the defined SLA

A compliance auditor requires the organization to demonstrate that it monitors for unauthorized access and reports incidents to management. The organization has a network monitoring system that generates alerts, but there is no formal process for reporting to management. What is the most important step for the manager to take?

Increase the number of monitoring alerts

Establish a formal incident reporting process that includes management notification

Provide the auditor with raw alert logs

Implement a new monitoring tool

What is the primary purpose of management reports generated from network monitoring data?

To provide executives with a high-level view of network health, security posture, and compliance status

To automatically remediate security vulnerabilities

To replace the need for real-time monitoring

To provide detailed packet-level analysis for forensic investigations

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 5)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 21–25

21application · medium
A security manager is evaluating a new monitoring tool. The tool provides detailed packet-level analysis and can reconstruct network sessions. The manager's primary goal is to detect zero-day exploits. Which type of monitoring is this tool best suited for?
Select an answer first
22expert · hard
A security analyst receives an alert for a potential malware infection on a laptop. The laptop is used by a senior executive and contains sensitive data. The incident response plan requires that the laptop be isolated immediately, but the executive is in an important client meeting and disconnecting would disrupt the presentation. What should the manager do?
Select an answer first
23application · medium
An IDS generates an alert for a known malware signature on a workstation. The alert is not correlated with any other suspicious activity. According to the incident response plan, low-priority alerts are reviewed within 24 hours. What should the manager do?
Select an answer first
24expert · hard
A compliance auditor requires the organization to demonstrate that it monitors for unauthorized access and reports incidents to management. The organization has a network monitoring system that generates alerts, but there is no formal process for reporting to management. What is the most important step for the manager to take?
Select an answer first
25foundation · easy
What is the primary purpose of management reports generated from network monitoring data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Network Monitoring for Managers GSLC Practice Questions (Page 5)

Questions 21–25

A security manager is evaluating a new monitoring tool. The tool provides detailed packet-level analysis and can reconstruct network sessions. The manager's primary goal is to detect zero-day exploits. Which type of monitoring is this tool best suited for?

An IDS generates an alert for a known malware signature on a workstation. The alert is not correlated with any other suspicious activity. According to the incident response plan, low-priority alerts are reviewed within 24 hours. What should the manager do?

What is the primary purpose of management reports generated from network monitoring data?

Keep studying — Security Operations and Incident Management