Network Forensics and Traffic Analysis GCIA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization needs to capture traffic on a 40 Gbps backbone link for security monitoring. The budget allows for either a commercial capture appliance with a dedicated tap or a software-based capture using a SPAN port. The monitoring team needs to retain full packets for 30 days and must be able to reconstruct sessions. Which solution is most appropriate?

   • ASoftware-based capture using a SPAN port on the switch.
   • BA load balancer that distributes traffic to multiple capture servers.
   • CCommercial capture appliance with a dedicated tap.
   • DNetFlow export from the switch with a flow collector.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A network analyst is investigating a potential data exfiltration. NetFlow records show a host sending large amounts of data to an external IP on port 443. The analyst also has firewall logs showing that the connection was allowed. The analyst needs to determine if the traffic is legitimate HTTPS or a covert channel. Which approach is most effective?

   • ACompare the NetFlow records with the firewall logs to verify the connection.
   • BUse a full packet capture of the session and inspect the TLS certificate and handshake.
   • CCheck the DNS logs for the external IP to see if it resolves to a known domain.
   • DUse NetFlow's application identification feature to classify the traffic.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team needs to share a packet capture with an external threat intelligence firm for collaborative analysis. The capture contains sensitive customer data, including IP addresses and email addresses. The team must anonymize the data while preserving the ability to analyze network behavior and detect anomalies. Which approach is most appropriate?

   • ARemove all payload data and keep only packet headers.
   • BEncrypt the capture file and share the decryption key separately.
   • CTruncate all packets to the first 64 bytes.
   • DUse a tool that replaces IP addresses with consistent pseudonyms and redacts email addresses in the payload.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic analyst needs to share a packet capture with a third-party threat intelligence vendor for analysis, but the capture contains sensitive employee IP addresses and usernames. The analyst must anonymize the data while preserving the ability to analyze protocol behavior and detect anomalies. Which approach best meets this requirement?

   • ARemove all payload data and keep only packet headers.
   • BReplace IP addresses with randomized but consistent pseudonyms and redact usernames in the payload.
   • CTruncate all packets to the first 64 bytes.
   • DEncrypt the entire capture file and share the decryption key separately.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key characteristic of a forensic report intended for a legal audience?

   • AIt focuses only on the final conclusion without supporting evidence
   • BIt uses highly technical jargon to demonstrate expertise
   • CIt clearly explains the methodology, findings, and conclusions in a way that is understandable to non-technical readers
   • DIt includes only raw packet captures without interpretation
   Reveal Solution Discussion Select an answer first