A forensic investigator has captured network traffic related to a security incident. The capture was performed using tcpdump on a Linux system. Which of the following actions is most important for maintaining a proper chain of custody for the capture file?

Email the capture file to the incident response team for quick access.

Compute a cryptographic hash of the capture file and document the hash value, along with the date, time, and investigator's name.

Compress the capture file to save space before analysis.

Store the capture file on the same system where it was captured to avoid copying errors.

What is the primary purpose of network forensics in the context of incident response?

To recover deleted files from endpoint hard drives for use as evidence in court

To monitor user productivity by reviewing web browsing history and email content

To capture and analyze network traffic to identify the source, scope, and impact of a security incident

To prevent all malicious traffic from entering the network by filtering packets at the perimeter

GIAC Certified Enterprise Defender

Domain 2Objective 3

Network Forensics, Logging, and Event Management GCED Practice Questions (Page 3)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
Which log source typically records authentication events such as successful and failed login attempts?
Select an answer first
12application · medium
A forensic investigator has captured network traffic related to a security incident. The capture was performed using tcpdump on a Linux system. Which of the following actions is most important for maintaining a proper chain of custody for the capture file?
Select an answer first
13foundation · easy
What is the primary purpose of network forensics in the context of incident response?
Select an answer first
14foundation · easy
Which command-line tool is commonly used to capture network traffic on a Linux system?
Select an answer first
15foundation · easy
Which log format is commonly used by web servers to record access requests?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Network Forensics, Logging, and Event Management GCED Practice Questions (Page 3)

Questions 11–15

Which log source typically records authentication events such as successful and failed login attempts?

A forensic investigator has captured network traffic related to a security incident. The capture was performed using tcpdump on a Linux system. Which of the following actions is most important for maintaining a proper chain of custody for the capture file?

What is the primary purpose of network forensics in the context of incident response?

Which command-line tool is commonly used to capture network traffic on a Linux system?

Which log format is commonly used by web servers to record access requests?

Keep studying — Incident Response and Forensics