What is the primary role of the rwflowpack daemon in the SiLK tool suite?

To visualize network traffic patterns

To collect flow records from network devices and store them in SiLK format

To query flow records from the SiLK repository

To aggregate flow records by specified fields

An analyst has a pcap file containing a suspicious HTTP session. The analyst needs to view the full contents of the TCP conversation between the client and server, including the data payloads, to determine if an exploit was sent. Which Wireshark feature is most appropriate?

Use the 'Statistics > Conversations' dialog to view packet counts.

Apply a display filter for 'http' and read each packet's info column.

Right-click a packet in the conversation and select 'Follow TCP Stream'.

Use 'File > Export Objects > HTTP' to save all HTTP objects.

A network analyst needs to summarize SiLK flow records to see the total bytes transferred between each pair of internal and external IP addresses, regardless of the number of individual connections. Which command produces this summary?

rwfilter --pass=stdout | rwcount --fields=sip,dip --bin-size=3600

rwfilter --pass=stdout | rwstats --fields=sip,dip --count=100 --top

rwfilter --pass=stdout | rwcut --fields=sip,dip,bytes

rwfilter --pass=stdout | rwgroup --fields=sip,dip --summarize=bytes

An analyst is using Argus to monitor a network segment. The analyst needs to generate a report of all flows involving a specific internal host, 192.168.10.5, and output the results in a human-readable format. Which Argus client tool is appropriate?

argus -r argus.log - host 192.168.10.5

rap -r argus.log - host 192.168.10.5

ra -r argus.log - host 192.168.10.5

racluster -r argus.log - host 192.168.10.5

GIAC Certified Intrusion Analyst

Domain 2Objective 2

SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 2)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

16concepts

Questions 6–10

6foundation · easy
Which rwcount option sets the length of the time interval for counting?
Select an answer first
7foundation · easy
What is the primary role of the rwflowpack daemon in the SiLK tool suite?
Select an answer first
8application · medium
An analyst has a pcap file containing a suspicious HTTP session. The analyst needs to view the full contents of the TCP conversation between the client and server, including the data payloads, to determine if an exploit was sent. Which Wireshark feature is most appropriate?
Select an answer first
9application · medium
A network analyst needs to summarize SiLK flow records to see the total bytes transferred between each pair of internal and external IP addresses, regardless of the number of individual connections. Which command produces this summary?
Select an answer first
10application · medium
An analyst is using Argus to monitor a network segment. The analyst needs to generate a report of all flows involving a specific internal host, 192.168.10.5, and output the results in a human-readable format. Which Argus client tool is appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.