During an investigation, an analyst extracts a URI from an HTTP request and a User-Agent string from the same flow. The analyst wants to correlate this activity with a specific asset on the network. Which additional piece of information is most essential to complete the correlation?

The HTTP method and response code

The packet capture timestamp and duration

The source IP address and port from the flow metadata

The destination IP address and port

A network analyst is monitoring a file server that normally receives SMB traffic from about 50 workstations during business hours. Over the past week, the analyst notices that one workstation is making SMB connections to the server at 3:00 AM every day, transferring a few megabytes each time. The workstation is not configured for any backup or update tasks. What should the analyst do first to investigate this anomaly?

Correlate the SMB session with the workstation's authentication logs and the files accessed to determine if the activity is legitimate.

Ignore the activity because it is a small amount of data and occurs outside business hours.

Block the workstation's IP address at the firewall to prevent further SMB connections.

Disable the SMB protocol on the file server to stop all SMB traffic.

GIAC Certified Detection Analyst

Domain 3Objective 2

Application Protocol Analytics GCDA Practice Questions (Page 6)

Part of the Network and Asset Analytics domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 6–10 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 26–30

26foundation · easy
During an investigation, an analyst extracts the 'User-Agent' header from HTTP requests. What type of metadata is this?
Select an answer first
27foundation · easy
An analyst notices a single internal host sending DNS queries for many distinct, randomly generated subdomains of a known malware domain. Which type of anomaly does this behavior represent?
Select an answer first
28foundation · easy
A security analyst notices a large volume of DNS TXT record queries from a single host to an external domain. Which anomaly is most likely indicated?
Select an answer first
29application · medium
During an investigation, an analyst extracts a URI from an HTTP request and a User-Agent string from the same flow. The analyst wants to correlate this activity with a specific asset on the network. Which additional piece of information is most essential to complete the correlation?
Select an answer first
30application · medium
A network analyst is monitoring a file server that normally receives SMB traffic from about 50 workstations during business hours. Over the past week, the analyst notices that one workstation is making SMB connections to the server at 3:00 AM every day, transferring a few megabytes each time. The workstation is not configured for any backup or update tasks. What should the analyst do first to investigate this anomaly?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Application Protocol Analytics GCDA Practice Questions (Page 6)

Questions 26–30

During an investigation, an analyst extracts the 'User-Agent' header from HTTP requests. What type of metadata is this?

An analyst notices a single internal host sending DNS queries for many distinct, randomly generated subdomains of a known malware domain. Which type of anomaly does this behavior represent?

A security analyst notices a large volume of DNS TXT record queries from a single host to an external domain. Which anomaly is most likely indicated?

During an investigation, an analyst extracts a URI from an HTTP request and a User-Agent string from the same flow. The analyst wants to correlate this activity with a specific asset on the network. Which additional piece of information is most essential to complete the correlation?

Keep studying — Network and Asset Analytics