GIAC Certified Intrusion Analyst
Domain 2Objective 2
SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 6)
Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)
49questions here
10free pages
16concepts
Questions 26–30
- 26
What is the primary analysis method used by Bro/Zeek?
Select an answer first - 27
An analyst needs to perform deep packet inspection to detect a specific application-layer exploit that is not visible in flow data. Which tool is most appropriate for this task?
Select an answer first - 28
What does rwstats primarily do with flow records?
Select an answer first - 29
An analyst is investigating a possible beaconing behavior from an internal host to an external IP. The analyst wants to visualize the communication patterns between the internal host and all external IPs over a week. Which SiLK tool is best for this visualization?
Select an answer first - 30
Which SiLK tool is used to generate top-N statistics from flow records?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.