SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   An analyst is investigating a possible malware infection that communicates over HTTP. The analyst has SiLK flow data and Zeek logs. The analyst needs to identify the internal hosts that communicated with a known malicious IP, and then determine if any of those hosts downloaded a specific file. Which approach best leverages both tools?

   • AUse tcpdump to capture all traffic to the malicious IP, then analyze with Wireshark.
   • BUse SiLK to find all flows to the malicious IP, then use Zeek logs to check for HTTP file downloads from that IP.
   • CUse Zeek to find all flows to the malicious IP, then use SiLK to check for HTTP file downloads.
   • DUse SiLK alone to identify the hosts and the file downloads.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An analyst is monitoring a network for a potential DDoS attack. The analyst needs to detect a sudden increase in the number of flows per minute. The SiLK repository contains flow data. Which command would best help the analyst see the flow rate over time?

   • Arwfilter --pass=stdout | rwgroup --fields=stime --bin-size=60
   • Brwfilter --pass=stdout | rwcount --bin-size=60
   • Crwfilter --pass=stdout | rwstats --fields=stime --count=10 --top
   • Drwfilter --pass=stdout | rwcut --fields=stime,sip,dip --bin-size=60
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An analyst is using SiLK to investigate a potential beaconing pattern from an internal host to an external IP. The analyst wants a visual representation of the communication over time to spot periodic connections. Which SiLK tool provides this visualization?

   • Arwstats --saddress=10.1.1.50 --daddress=203.0.113.9 --fields=stime --count=100
   • Brwcount --saddress=10.1.1.50 --daddress=203.0.113.9 --bin-size=3600
   • Crwipview --saddress=10.1.1.50 --daddress=203.0.113.9 --start-date=2025/03/01 --end-date=2025/03/07
   • Drwgroup --saddress=10.1.1.50 --daddress=203.0.113.9 --fields=stime
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which tcpdump option is used to write captured packets to a file?

   • A-c
   • B-r
   • C-w
   • D-v
   Reveal Solution Discussion Select an answer first