A network analyst needs to summarize all flow records from the past day into a single record per source IP and destination port pair, to reduce the volume of data for a report. Which SiLK command should be used?

rwcount --fields=sip,dport --bin-size=3600

rwstats --fields=sip,dport --top=100

rwfilter --fields=sip,dport --pass=stdout

rwgroup --fields=sip,dport --pass=stdout

Why might an analyst combine SiLK with Bro/Zeek?

To replace SiLK with Bro/Zeek for all analysis

To use SiLK for packet capture and Bro/Zeek for flow analysis

To convert Bro/Zeek logs into SiLK flow records

To leverage SiLK's flow analysis for broad patterns and Bro/Zeek's deep packet inspection for detailed logs

What type of logs does Bro/Zeek generate for security analysis?

Connection logs, DNS logs, and HTTP logs

An analyst has a pcap file from a SPAN port and wants to integrate the data into the existing SiLK flow repository for long-term analysis. The analyst needs to convert the pcap to SiLK flow records and then insert them into the repository. Which sequence of commands accomplishes this?

tcpdump -r capture.pcap -w /var/silk/data/flows.silk

rwcount --input-file=capture.pcap --output-path=/var/silk/data

rwptoflow --input-file=capture.pcap --output-path=/tmp/flows && rwappend --input-path=/tmp/flows --output-path=/var/silk/data

rwfilter --input-file=capture.pcap --pass=stdout | rwappend --output-path=/var/silk/data

GIAC Certified Intrusion Analyst

Domain 2Objective 2

SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 3)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

16concepts

Questions 11–15

11application · medium
A network analyst needs to summarize all flow records from the past day into a single record per source IP and destination port pair, to reduce the volume of data for a report. Which SiLK command should be used?
Select an answer first
12foundation · easy
Which Python module is commonly used to access SiLK flow data?
Select an answer first
13foundation · easy
Why might an analyst combine SiLK with Bro/Zeek?
Select an answer first
14foundation · easy
What type of logs does Bro/Zeek generate for security analysis?
Select an answer first
15application · medium
An analyst has a pcap file from a SPAN port and wants to integrate the data into the existing SiLK flow repository for long-term analysis. The analyst needs to convert the pcap to SiLK flow records and then insert them into the repository. Which sequence of commands accomplishes this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.