An analyst has completed a forensic analysis of a network intrusion and needs to produce a report that will be used in legal proceedings. The report must be understandable to non-technical stakeholders while preserving technical accuracy. Which approach is most appropriate?

Summarize the findings in a single paragraph without any technical details.

Provide an executive summary with high-level findings and a technical appendix with detailed packet analysis.

Write the report using only technical jargon and packet-level details.

Include raw packet captures in the report without explanation.

An intrusion analyst has completed a forensic investigation and must present findings to a jury in a legal case. The jury is not technically sophisticated, and the defense attorney is likely to challenge the reliability of the network evidence. What is the most effective way to present the findings?

Use legal jargon to match the courtroom setting.

Use simple diagrams and analogies to explain the attack flow, and clearly state the conclusions.

Avoid discussing the technical details and focus only on the final conclusion.

Present a detailed technical report with packet-level analysis to demonstrate thoroughness.

An analyst is investigating a security incident and has access to NetFlow records, DNS logs, and a packet capture from the affected segment. The analyst needs to determine the order of events leading to the compromise. Which approach is most effective for building a timeline?

Rely solely on the packet capture because it contains the most detail.

Correlate timestamps from the NetFlow records, DNS logs, and packet capture to establish a sequence of events.

Analyze the DNS logs first and then ignore the other sources.

Use only the NetFlow records because they cover the longest time period.

An analyst is analyzing a pcap and sees an HTTP response that is fragmented across multiple TCP segments. The analyst needs to extract the complete response body to check for a malicious payload. What is the most reliable method to reconstruct the full HTTP response?

Use the 'Export Objects' feature to extract the HTTP response.

Manually reassemble the segments by sorting them by sequence number.

Filter for packets with the PSH flag to capture the response body.

Use the 'Follow TCP Stream' feature to reassemble the session.

GIAC Certified Intrusion Analyst

Domain 2Objective 1

Network Forensics and Traffic Analysis GCIA Practice Questions (Page 5)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 21–25

21application · medium
An analyst has completed a forensic analysis of a network intrusion and needs to produce a report that will be used in legal proceedings. The report must be understandable to non-technical stakeholders while preserving technical accuracy. Which approach is most appropriate?
Select an answer first
22expert · hard
An intrusion analyst has completed a forensic investigation and must present findings to a jury in a legal case. The jury is not technically sophisticated, and the defense attorney is likely to challenge the reliability of the network evidence. What is the most effective way to present the findings?
Select an answer first
23foundation · easy
Which traffic capture method involves configuring a switch to send a copy of traffic from one or more ports to a monitoring port?
Select an answer first
24application · medium
An analyst is investigating a security incident and has access to NetFlow records, DNS logs, and a packet capture from the affected segment. The analyst needs to determine the order of events leading to the compromise. Which approach is most effective for building a timeline?
Select an answer first
25application · medium
An analyst is analyzing a pcap and sees an HTTP response that is fragmented across multiple TCP segments. The analyst needs to extract the complete response body to check for a malicious payload. What is the most reliable method to reconstruct the full HTTP response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Network Forensics and Traffic Analysis GCIA Practice Questions (Page 5)

Questions 21–25

An analyst has completed a forensic analysis of a network intrusion and needs to produce a report that will be used in legal proceedings. The report must be understandable to non-technical stakeholders while preserving technical accuracy. Which approach is most appropriate?

Which traffic capture method involves configuring a switch to send a copy of traffic from one or more ports to a monitoring port?

An analyst is investigating a security incident and has access to NetFlow records, DNS logs, and a packet capture from the affected segment. The analyst needs to determine the order of events leading to the compromise. Which approach is most effective for building a timeline?

An analyst is analyzing a pcap and sees an HTTP response that is fragmented across multiple TCP segments. The analyst needs to extract the complete response body to check for a malicious payload. What is the most reliable method to reconstruct the full HTTP response?

Keep studying — Traffic Analysis and Tools