A network monitoring system shows a gradual increase in outbound traffic from a file server over three months, from 10 GB/day to 50 GB/day. The increase is spread across many internal users and external IPs. There are no alerts from the IDS. What is the most appropriate interpretation?

A data exfiltration incident is underway

The IDS is failing to detect malicious activity

Likely legitimate growth in business use, but should be validated against business activity

The network is congested and needs an upgrade

What is the primary role of a manager when a monitoring alert indicates a potential security incident?

To personally analyze packet captures to determine the attack vector

To ensure the alert is properly triaged, escalate if necessary, and allocate resources for response

To immediately disconnect all network connections to contain the incident

To ignore the alert if it occurs outside business hours

An organization needs to monitor a high-speed data center network for both performance and security. The budget is limited, and the team has expertise in both SNMP and NetFlow. Which approach provides the best balance of visibility and cost?

Use SNMP for device health and NetFlow for traffic analysis

Use only NetFlow to get traffic details

Deploy full packet capture on all switches

GIAC Security Leadership

Domain 3Objective 2

Network Monitoring for Managers GSLC Practice Questions (Page 9)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 41–45

41expert · hard
A network monitoring system shows a gradual increase in outbound traffic from a file server over three months, from 10 GB/day to 50 GB/day. The increase is spread across many internal users and external IPs. There are no alerts from the IDS. What is the most appropriate interpretation?
Select an answer first
42foundation · easy
What is the primary role of a manager when a monitoring alert indicates a potential security incident?
Select an answer first
43application · medium
A manager needs to monitor network traffic to detect a possible data exfiltration attempt. The organization currently uses SNMP for device health and performance monitoring. Which additional technology would be most effective for this purpose?
Select an answer first
44foundation · easy
Which network monitoring metric specifically measures the percentage of data packets that fail to reach their destination?
Select an answer first
45expert · hard
An organization needs to monitor a high-speed data center network for both performance and security. The budget is limited, and the team has expertise in both SNMP and NetFlow. Which approach provides the best balance of visibility and cost?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Network Monitoring for Managers GSLC Practice Questions (Page 9)

Questions 41–45

A network monitoring system shows a gradual increase in outbound traffic from a file server over three months, from 10 GB/day to 50 GB/day. The increase is spread across many internal users and external IPs. There are no alerts from the IDS. What is the most appropriate interpretation?

What is the primary role of a manager when a monitoring alert indicates a potential security incident?

A manager needs to monitor network traffic to detect a possible data exfiltration attempt. The organization currently uses SNMP for device health and performance monitoring. Which additional technology would be most effective for this purpose?

Which network monitoring metric specifically measures the percentage of data packets that fail to reach their destination?

An organization needs to monitor a high-speed data center network for both performance and security. The budget is limited, and the team has expertise in both SNMP and NetFlow. Which approach provides the best balance of visibility and cost?

Keep studying — Security Operations and Incident Management