Network Forensics and Traffic Analysis GCIA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is investigating a multi-stage attack. The analyst has NetFlow records, DNS logs, and a packet capture from a specific time window. The packet capture shows the initial compromise, but the NetFlow records show ongoing communication after the capture ended. The analyst needs to build a complete timeline of the attack. What is the most effective approach?

   • AUse the packet capture for the initial compromise and the NetFlow records to extend the timeline beyond the capture window.
   • BRely solely on the NetFlow records because they cover a longer time period.
   • CRely solely on the packet capture because it contains the most detail.
   • DUse the DNS logs to fill in the gaps between the packet capture and NetFlow records.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of correlating network traffic with system logs in a forensic investigation?

   • ATo automatically block malicious IP addresses
   • BTo reduce the size of the packet capture files
   • CTo encrypt the logs for secure storage
   • DTo build a comprehensive timeline of events that combines evidence from multiple sources
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An incident responder is building a timeline of a breach. They have NetFlow records, firewall logs, and a partial packet capture. The packet capture starts after the initial compromise but includes the lateral movement phase. Which combination of data sources is most effective for establishing the initial entry point?

   • ANetFlow records and firewall logs from the period before the packet capture.
   • BNetFlow records and the packet capture, ignoring firewall logs.
   • CFirewall logs and the packet capture, correlating timestamps.
   • DThe packet capture alone, focusing on the first packets.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which flow record field is most useful for identifying the application protocol used in a communication?

   • ASource and destination ports
   • BFlow start and end timestamps
   • CSource and destination IP addresses
   • DTotal bytes transferred
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has just experienced a security incident and the incident response team needs to preserve evidence for potential legal action. The team has access to a SPAN port and a network tap. Which action is most important to ensure the admissibility of network evidence?

   • AAnalyze the traffic immediately to identify the attacker.
   • BUse the SPAN port to avoid any physical disruption.
   • CCapture traffic using the network tap instead of the SPAN port.
   • DDocument the chain of custody for the captured traffic.
   Reveal Solution Discussion Select an answer first