During analysis of a pcap file, you notice a series of TCP SYN packets sent to a single host on consecutive ports, each followed by a SYN-ACK response. The source IP is consistent, and the packets are spaced exactly 2 seconds apart. What does this pattern most likely indicate?

A port scan being performed by the source host.

A misconfigured router sending ICMP redirects.

Normal TCP connection establishment for a multi-threaded application.

A denial-of-service attack flooding the target with SYN packets.

You are a forensic analyst collecting network evidence from a compromised server. You have captured a pcap file and need to document its chain of custody. Which action is most important to maintain the integrity of the evidence?

Email the pcap file to the legal team for review.

Store the pcap file on the analyst's local workstation for easy access.

Record the hash value of the pcap file immediately after capture and document who handled it.

Convert the pcap file to a text file for readability.

An incident responder needs to capture network traffic on a high-throughput link (10 Gbps) during a suspected breach. The capture must be complete and not drop packets. Which tool or method is most appropriate?

Use NetFlow to collect flow records instead of full packet capture.

Use tcpdump on a standard server with a 1 Gbps NIC.

Use Wireshark on a laptop connected to the network.

Use a dedicated hardware tap with a capture appliance that writes to high-speed storage.

A forensic examiner is asked to capture network traffic from a corporate network that includes traffic from a guest Wi-Fi network. The company's privacy policy states that guest traffic is not monitored. What should the examiner do?

Exclude the guest network from the capture to comply with the privacy policy.

Ask the guest users for consent before capturing.

Capture all traffic including guest traffic to ensure no evidence is missed.

Capture guest traffic but anonymize the IP addresses.

Which of the following is a proper procedure for preserving network evidence?

Compress the data to save space

Calculate a cryptographic hash of the captured data

Email the data to the forensic analyst

Store the data on a shared network drive

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 1

Data on the Network GBFA Practice Questions (Page 5)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 21–25

21application · medium
During analysis of a pcap file, you notice a series of TCP SYN packets sent to a single host on consecutive ports, each followed by a SYN-ACK response. The source IP is consistent, and the packets are spaced exactly 2 seconds apart. What does this pattern most likely indicate?
Select an answer first
22application · medium
You are a forensic analyst collecting network evidence from a compromised server. You have captured a pcap file and need to document its chain of custody. Which action is most important to maintain the integrity of the evidence?
Select an answer first
23application · medium
An incident responder needs to capture network traffic on a high-throughput link (10 Gbps) during a suspected breach. The capture must be complete and not drop packets. Which tool or method is most appropriate?
Select an answer first
24application · medium
A forensic examiner is asked to capture network traffic from a corporate network that includes traffic from a guest Wi-Fi network. The company's privacy policy states that guest traffic is not monitored. What should the examiner do?
Select an answer first
25foundation · easy
Which of the following is a proper procedure for preserving network evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.