A security analyst needs to inspect the contents of individual packets to investigate a suspected malware communication. Which tool is most appropriate for this task?

Packet analyzer (e.g., Wireshark)

A security manager is reviewing monitoring data and sees a pattern of small outbound connections from multiple internal hosts to the same external IP address at regular intervals. The connections are encrypted and occur every 10 minutes. The manager must determine if this is a security incident. What is the most appropriate next step?

Disable the internal hosts' network access

Investigate the external IP address and the purpose of the connections

Block the external IP address immediately

Ignore the pattern because it is regular and encrypted

Which of the following best describes how monitoring alerts trigger incident response processes?

Alerts are correlated and analyzed to determine if they represent a real incident, and then the response plan is activated.

Alerts are only used for reporting and do not affect incident response.

Every alert automatically initiates a full incident response activation.

Alerts are stored for post-incident analysis but are not used in real-time.

A manager needs to choose a monitoring approach for a small office with a single internet connection and no dedicated security staff. The goal is to detect unusual outbound traffic patterns that might indicate malware. Which approach is most practical?

Rely on the ISP's monthly traffic report

Use only SNMP interface counters

Deploy a full packet capture appliance on the internet link

Enable NetFlow on the router and review weekly flow reports

A security analyst reports that a server normally sending 2 Mbps of outbound traffic has suddenly been sending 80 Mbps to a single external IP address for the past 30 minutes. The performance monitoring dashboard shows no other anomalies. What should the manager direct the analyst to do first?

Ignore it because performance monitoring shows no other issues

Reboot the server to clear the network connection

Increase the bandwidth limit on the server's network interface

Treat it as a potential data exfiltration incident and initiate the incident response process

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 8)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 36–40

36foundation · easy
A security analyst needs to inspect the contents of individual packets to investigate a suspected malware communication. Which tool is most appropriate for this task?
Select an answer first
37expert · hard
A security manager is reviewing monitoring data and sees a pattern of small outbound connections from multiple internal hosts to the same external IP address at regular intervals. The connections are encrypted and occur every 10 minutes. The manager must determine if this is a security incident. What is the most appropriate next step?
Select an answer first
38foundation · easy
Which of the following best describes how monitoring alerts trigger incident response processes?
Select an answer first
39application · medium
A manager needs to choose a monitoring approach for a small office with a single internet connection and no dedicated security staff. The goal is to detect unusual outbound traffic patterns that might indicate malware. Which approach is most practical?
Select an answer first
40application · medium
A security analyst reports that a server normally sending 2 Mbps of outbound traffic has suddenly been sending 80 Mbps to a single external IP address for the past 30 minutes. The performance monitoring dashboard shows no other anomalies. What should the manager direct the analyst to do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.