An intrusion analyst has completed a network forensics investigation and must present findings to both the IT team and the company's legal counsel. The legal counsel needs to understand the technical evidence without being overwhelmed by jargon. What is the most effective way to structure the report?

Present only the final conclusion without supporting evidence to avoid confusion.

Use a legal document format with citations to case law and statutes.

Provide a single technical report with detailed packet-level analysis for both audiences.

Write an executive summary with plain-language findings and include a technical appendix for the IT team.

A forensic analyst needs to share a packet capture with an external legal team for review. The capture contains personal information of customers, including IP addresses and usernames. The analyst must protect the privacy of individuals while still allowing the legal team to analyze the traffic patterns. Which approach best balances privacy and analytical value?

Encrypt the capture file and share the decryption key with the legal team.

Remove all packet payloads and share only the packet headers.

Anonymize IP addresses and usernames using a consistent mapping scheme.

Share only the NetFlow records instead of the full packet capture.

An analyst is examining a pcap from a suspected phishing campaign. The capture shows an HTTP POST to a website, and the analyst needs to extract the credentials that were submitted. Which approach is most effective?

Use a protocol analyzer to decode the TCP payload and manually reassemble.

Use tcpdump to filter for HTTP and save the raw packets.

Use Wireshark's 'Follow HTTP Stream' to view the POST data.

Use NetFlow to identify the flow and then query the server logs.

An analyst is investigating a malware infection. The packet capture shows an HTTP session where a binary file was downloaded. The analyst needs to extract the binary for analysis, but the capture also contains other HTTP traffic. Which approach is most reliable for extracting the correct file?

Use tcpdump to capture the traffic again and save the raw packets.

Use Wireshark's 'Export Objects' feature and select the HTTP object by its URI.

Use NetworkMiner to extract all files and then identify the binary by file signature.

Use a custom script to parse the HTTP headers and extract the body.

GIAC Certified Intrusion Analyst

Domain 2Objective 1

Network Forensics and Traffic Analysis GCIA Practice Questions (Page 8)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 36–40

36application · medium
An intrusion analyst has completed a network forensics investigation and must present findings to both the IT team and the company's legal counsel. The legal counsel needs to understand the technical evidence without being overwhelmed by jargon. What is the most effective way to structure the report?
Select an answer first
37application · medium
A forensic analyst needs to share a packet capture with an external legal team for review. The capture contains personal information of customers, including IP addresses and usernames. The analyst must protect the privacy of individuals while still allowing the legal team to analyze the traffic patterns. Which approach best balances privacy and analytical value?
Select an answer first
38application · medium
An analyst is examining a pcap from a suspected phishing campaign. The capture shows an HTTP POST to a website, and the analyst needs to extract the credentials that were submitted. Which approach is most effective?
Select an answer first
39expert · medium
An analyst is investigating a malware infection. The packet capture shows an HTTP session where a binary file was downloaded. The analyst needs to extract the binary for analysis, but the capture also contains other HTTP traffic. Which approach is most reliable for extracting the correct file?
Select an answer first
40foundation · easy
What type of artifact can be extracted from a packet capture that contains an unencrypted HTTP login?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Network Forensics and Traffic Analysis GCIA Practice Questions (Page 8)

Questions 36–40

An analyst is examining a pcap from a suspected phishing campaign. The capture shows an HTTP POST to a website, and the analyst needs to extract the credentials that were submitted. Which approach is most effective?

An analyst is investigating a malware infection. The packet capture shows an HTTP session where a binary file was downloaded. The analyst needs to extract the binary for analysis, but the capture also contains other HTTP traffic. Which approach is most reliable for extracting the correct file?

What type of artifact can be extracted from a packet capture that contains an unencrypted HTTP login?

Keep studying — Traffic Analysis and Tools