Network Forensics and Traffic Analysis GCIA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic analyst is investigating a data breach. The packet capture contains an FTP session where a file was transferred, but the capture is incomplete: some data packets are missing, and the TCP stream has gaps. The analyst needs to extract the file for malware analysis. The capture also includes a second FTP session that appears complete. Which approach is most likely to yield a usable file?

   • AUse the complete FTP session instead, assuming it contains the same file.
   • BRequest the file from the FTP server logs.
   • CUse Wireshark's 'Follow TCP Stream' on the incomplete session and save the raw data.
   • DAttempt to reassemble the incomplete FTP session using tcpflow and then use file carving on the resulting data.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is preparing for a potential legal case involving a network intrusion. The legal team requires that network evidence be preserved in a way that maintains its integrity and adheres to the chain of custody. What is the most important practice to follow when capturing and handling network traffic?

   • AUse a dedicated capture system with write-protected storage and document every handling step.
   • BCapture traffic using the analyst's personal laptop for convenience.
   • CStore the captures on a shared network drive for easy access by the team.
   • DCompress the capture files to save space and speed up analysis.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst needs to capture traffic on a critical production segment to investigate a suspected data exfiltration. The switch is a high-end model with limited SPAN resources, and the segment carries a mix of normal business traffic and occasional large file transfers. The analyst must ensure that no packets are dropped during peak utilization and that the capture does not disrupt production. Which approach best meets these requirements?

   • AUse a remote packet capture agent installed on each server in the segment.
   • BEnable NetFlow export on the switch and collect flow records for analysis.
   • CConfigure a SPAN port on the switch and send traffic to the analyst's workstation for capture.
   • DInstall an inline network tap on the segment and connect it to a dedicated capture appliance.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When analyzing a packet capture, which combination of fields uniquely identifies a TCP connection?

   • ASource IP, destination IP, source port, destination port, and protocol
   • BSource IP address and destination IP address
   • CSource port and destination port
   • DMAC addresses and VLAN ID
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a packet analysis, an analyst observes a TCP connection where the initial sequence number (ISN) is set to 0 and the window size is set to a very small value. The connection is to a known malicious IP address. What does this combination of characteristics most likely indicate?

   • AA sign of network congestion causing window size reduction.
   • BA misconfigured but legitimate client.
   • CA normal TCP connection from an older operating system.
   • DA crafted packet or a tool that does not implement TCP correctly.
   Reveal Solution Discussion Select an answer first