A security analyst is investigating a potential data exfiltration. The SIEM shows a large amount of data being transferred from an internal server to an external IP address via FTP. The analyst also sees that the same external IP was used in a previous incident. However, the FTP traffic is not encrypted. What is the best way to confirm the exfiltration?

Block the external IP address immediately.

Capture and analyze the FTP traffic to see the data being transferred.

Check the firewall logs for the FTP traffic.

Use the SIEM to correlate the FTP traffic with the user's activity.

An analyst is reviewing logs from multiple sources and notices that the timestamps are in different formats. The firewall logs use UTC, the web server logs use local time, and the IDS logs use epoch time. The analyst needs to correlate events across these sources. What is the best approach?

Ignore the timestamps and rely on the sequence of events.

Convert all timestamps to UTC during analysis.

Use the local timezone of the analyst as the standard.

Use the epoch time as the standard because it is unambiguous.

In network traffic analysis, what does a sudden spike in outbound traffic from a single host to an external IP often indicate?

Possible data exfiltration or command-and-control communication

Normal software update activity

A network loop causing broadcast storms

Which activity is a core function of network forensics during incident response?

Reconstructing network sessions to determine what an attacker did after compromising a host

Patching vulnerabilities identified on servers to prevent further exploitation

Configuring firewall rules to block known malicious IP addresses

Conducting employee interviews to gather information about suspicious activity

GIAC Certified Enterprise Defender

Domain 2Objective 3

Network Forensics, Logging, and Event Management GCED Practice Questions (Page 7)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 31–35

31expert · hard
A security analyst is investigating a potential data exfiltration. The SIEM shows a large amount of data being transferred from an internal server to an external IP address via FTP. The analyst also sees that the same external IP was used in a previous incident. However, the FTP traffic is not encrypted. What is the best way to confirm the exfiltration?
Select an answer first
32foundation · easy
Which tool provides a graphical interface for capturing and analyzing network packets?
Select an answer first
33expert · hard
An analyst is reviewing logs from multiple sources and notices that the timestamps are in different formats. The firewall logs use UTC, the web server logs use local time, and the IDS logs use epoch time. The analyst needs to correlate events across these sources. What is the best approach?
Select an answer first
34foundation · easy
In network traffic analysis, what does a sudden spike in outbound traffic from a single host to an external IP often indicate?
Select an answer first
35foundation · easy
Which activity is a core function of network forensics during incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Network Forensics, Logging, and Event Management GCED Practice Questions (Page 7)

Questions 31–35

Which tool provides a graphical interface for capturing and analyzing network packets?

An analyst is reviewing logs from multiple sources and notices that the timestamps are in different formats. The firewall logs use UTC, the web server logs use local time, and the IDS logs use epoch time. The analyst needs to correlate events across these sources. What is the best approach?

In network traffic analysis, what does a sudden spike in outbound traffic from a single host to an external IP often indicate?

Which activity is a core function of network forensics during incident response?

Keep studying — Incident Response and Forensics