What is the purpose of TCP stream reassembly in network traffic analysis?

To compress the capture file to reduce storage requirements

To reconstruct the original data stream from packets that may have arrived out of order or been fragmented

To decrypt encrypted traffic without the encryption keys

To identify the source and destination MAC addresses of the communication

What is the primary purpose of network forensics in the context of incident response?

To capture and analyze network traffic to determine what happened during a security incident and to support legal proceedings

To optimize network performance by identifying bottlenecks and tuning routing protocols

To prevent unauthorized access to the network by blocking malicious traffic in real time

To encrypt all network communications to ensure confidentiality of data in transit

What is the goal of anonymizing IP addresses in a packet capture before sharing it with third parties?

To make the traffic unreadable to unauthorized users

To comply with network performance requirements

To reduce the file size of the capture

To protect the privacy of individuals and organizations while preserving the analytical value of the traffic data

GIAC Certified Intrusion Analyst

Domain 2Objective 1

Network Forensics and Traffic Analysis GCIA Practice Questions (Page 4)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 16–20

16foundation · easy
Which section of a forensic report should include the analyst's overall assessment of what occurred during the incident?
Select an answer first
17foundation · easy
What is the purpose of TCP stream reassembly in network traffic analysis?
Select an answer first
18foundation · easy
Which DNS record type is used to map a hostname to an IPv4 address?
Select an answer first
19foundation · easy
What is the primary purpose of network forensics in the context of incident response?
Select an answer first
20foundation · easy
What is the goal of anonymizing IP addresses in a packet capture before sharing it with third parties?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Network Forensics and Traffic Analysis GCIA Practice Questions (Page 4)

Questions 16–20

Which section of a forensic report should include the analyst's overall assessment of what occurred during the incident?

What is the purpose of TCP stream reassembly in network traffic analysis?

Which DNS record type is used to map a hostname to an IPv4 address?

What is the primary purpose of network forensics in the context of incident response?

What is the goal of anonymizing IP addresses in a packet capture before sharing it with third parties?

Keep studying — Traffic Analysis and Tools