Network Forensics and Traffic Analysis GCIA Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A network analyst is reviewing NetFlow records and notices a single internal host communicating with an external IP on port 53 using UDP, with flow records showing small packet sizes and consistent intervals every 10 minutes over several days. The analyst needs to determine if this is a DNS issue or something else. Which additional data source would most directly confirm whether this is legitimate DNS traffic?

   • ANetFlow records from the same period to verify packet counts.
   • BRouter interface counters to check for errors.
   • CFull packet capture of the DNS traffic to inspect the query and response payloads.
   • DFirewall logs showing the source and destination IPs.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security analyst is reviewing a packet capture and sees a TCP connection with the SYN flag set, followed immediately by a RST, repeated every few seconds from the same source IP to a single destination port 445. The source IP is a known internal workstation. Which interpretation is most consistent with this pattern?

   • AThe workstation is experiencing a TCP retransmission timeout.
   • BThe workstation is using a tunneling protocol over port 445.
   • CThe workstation is sending a TCP reset to terminate an established session.
   • DThe workstation is scanning the destination for an open SMB service.
   Reveal Solution Discussion Select an answer first