You have captured network evidence from a corporate network. The legal team requests that you provide the evidence in a format that can be used in court. What is the most important step to ensure the evidence is admissible?

Store the evidence on a personal USB drive to keep it secure.

Convert the pcap file to a PDF report for readability.

Delete any irrelevant traffic to simplify the evidence.

Document the entire acquisition process, including who, what, when, where, and how the evidence was collected.

What is the primary purpose of maintaining a chain of custody for network evidence?

To demonstrate that the evidence has not been altered or tampered with

To speed up the forensic analysis process

To ensure the evidence is stored on the most expensive storage media

To make the evidence available to all interested parties

While analyzing a pcap, you see a TCP handshake where the client sends a SYN, the server responds with SYN-ACK, and the client sends an ACK. Immediately after, the client sends a RST. What does this pattern suggest?

The client is performing a SYN flood attack.

The server is refusing the connection.

The connection is being established normally.

The client completed the handshake but then terminated the connection, possibly indicating a port scan or a client-side application issue.

Which of the following is a common method for capturing network traffic for forensic analysis?

Using a hub in place of a switch

Installing a packet sniffer on every host

Reading the ARP cache on the router

During a network traffic analysis, an examiner notices that a workstation is sending HTTP requests to an external IP address on port 8080 at regular intervals, even when the user is not actively browsing. The requests contain small amounts of data in the URL parameters. What is the most likely explanation?

The workstation is experiencing a network misconfiguration causing traffic to be redirected.

The workstation is sending telemetry to a third-party analytics service.

The workstation is part of a botnet and is communicating with a command-and-control server.

The workstation is performing automatic software updates.

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 1

Data on the Network GBFA Practice Questions (Page 4)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 16–20

16application · medium
You have captured network evidence from a corporate network. The legal team requests that you provide the evidence in a format that can be used in court. What is the most important step to ensure the evidence is admissible?
Select an answer first
17foundation · easy
What is the primary purpose of maintaining a chain of custody for network evidence?
Select an answer first
18application · medium
While analyzing a pcap, you see a TCP handshake where the client sends a SYN, the server responds with SYN-ACK, and the client sends an ACK. Immediately after, the client sends a RST. What does this pattern suggest?
Select an answer first
19foundation · easy
Which of the following is a common method for capturing network traffic for forensic analysis?
Select an answer first
20application · medium
During a network traffic analysis, an examiner notices that a workstation is sending HTTP requests to an external IP address on port 8080 at regular intervals, even when the user is not actively browsing. The requests contain small amounts of data in the URL parameters. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.