A network monitoring system shows that a database server's inbound traffic has doubled over the past week, but CPU and memory utilization are unchanged. The increase is from a single application server. What should the manager do first?

Ignore it because CPU and memory are unchanged

Block the application server's IP address

Increase the database server's network bandwidth

Investigate whether the application server is generating legitimate additional queries or if a misconfiguration is causing a loop

A manager is reviewing two alerts: one from the performance monitoring system indicating high CPU on a web server, and one from the IDS indicating a port scan from an internal IP. Which alert should be escalated to the incident response team first?

Both alerts equally, because both are important

The high CPU alert, because it affects availability

Neither alert, because they are not correlated

The IDS port scan alert, because it indicates a potential security incident

A security manager is reviewing the monitoring alerting policy. The policy currently sends all alerts to a single email distribution list. During a recent incident, the alert was sent but no one responded for over an hour. What is the most effective improvement?

Implement tiered alerting with defined escalation paths and on-call rotations

Require all employees to monitor the email list

Disable alerts that are not critical

Increase the frequency of alert emails

A network monitoring alert fires at 2:00 AM indicating a potential brute-force attack on a critical database server. The on-call technician acknowledges the alert but does not escalate to the security team, believing it is a false positive. By morning, the server has been compromised. What is the most important lesson for the manager?

Rely on the on-call technician's judgment for all security alerts

Ensure that monitoring alerts have a clear escalation path and that on-call staff are trained to escalate potential security incidents

Require on-call staff to wait for multiple alerts before escalating

Disable alerts during off-hours to avoid alert fatigue

A compliance auditor asks for evidence that the organization monitors its network for unauthorized access. The manager needs to provide a report that demonstrates ongoing monitoring and response. Which approach best satisfies this requirement?

Provide a list of the network monitoring tools installed

Provide a summary of monitoring alerts and the corresponding incident response actions taken over the past quarter

Provide the network architecture diagram

Provide a copy of the monitoring policy

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 6)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 26–30

26application · medium
A network monitoring system shows that a database server's inbound traffic has doubled over the past week, but CPU and memory utilization are unchanged. The increase is from a single application server. What should the manager do first?
Select an answer first
27application · medium
A manager is reviewing two alerts: one from the performance monitoring system indicating high CPU on a web server, and one from the IDS indicating a port scan from an internal IP. Which alert should be escalated to the incident response team first?
Select an answer first
28application · medium
A security manager is reviewing the monitoring alerting policy. The policy currently sends all alerts to a single email distribution list. During a recent incident, the alert was sent but no one responded for over an hour. What is the most effective improvement?
Select an answer first
29application · medium
A network monitoring alert fires at 2:00 AM indicating a potential brute-force attack on a critical database server. The on-call technician acknowledges the alert but does not escalate to the security team, believing it is a false positive. By morning, the server has been compromised. What is the most important lesson for the manager?
Select an answer first
30application · medium
A compliance auditor asks for evidence that the organization monitors its network for unauthorized access. The manager needs to provide a report that demonstrates ongoing monitoring and response. Which approach best satisfies this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.