What is the primary function of rwcount in SiLK?

Counts flows and packets over time intervals

Filters flow records by criteria

Aggregates flow records by fields

An analyst is monitoring a network for a potential denial-of-service attack. The analyst needs to see the total number of packets and bytes for all traffic over the last hour, broken down into 5-minute intervals, to identify spikes. Which SiLK tool is best suited for this task?

rwcount --bin-size=300 --start-date=... --end-date=...

rwgroup --fields=sip --bin-size=300

rwfilter --bin-size=300 --pass=stdout

rwstats --fields=bytes --top=10

A network engineer is setting up SiLK to collect flow data from a router. The router exports NetFlow v9 to the SiLK sensor. What is the role of the SiLK sensor in this architecture?

The sensor performs deep packet inspection and generates alerts.

The sensor aggregates flow records and generates top-N statistics.

The sensor captures raw packets and stores them for later analysis.

The sensor receives NetFlow records, converts them into SiLK flow records, and writes them to the SiLK repository.

An analyst has a pcap file from a network tap and needs to convert it to SiLK flow records for analysis. The pcap file is large (10 GB), and the analyst wants to minimize the time and disk usage. Which approach is most efficient?

Use tcpdump to read the pcap and write a new pcap with only the packets of interest, then convert with rwptoflow.

Use rwfilter directly on the pcap file to extract flows.

Use rwptoflow to convert the pcap directly to SiLK flow format, then use rwfilter to analyze the resulting flow file.

Use Wireshark to open the pcap and export the flows as CSV, then import into SiLK.

GIAC Certified Intrusion Analyst

Domain 2Objective 2

SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 7)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

16concepts

Questions 31–35

31foundation · easy
What is the primary function of rwcount in SiLK?
Select an answer first
32application · medium
An analyst is monitoring a network for a potential denial-of-service attack. The analyst needs to see the total number of packets and bytes for all traffic over the last hour, broken down into 5-minute intervals, to identify spikes. Which SiLK tool is best suited for this task?
Select an answer first
33foundation · easy
Which SiLK tool is used to convert raw packet capture files into SiLK flow records?
Select an answer first
34application · medium
A network engineer is setting up SiLK to collect flow data from a router. The router exports NetFlow v9 to the SiLK sensor. What is the role of the SiLK sensor in this architecture?
Select an answer first
35expert · hard
An analyst has a pcap file from a network tap and needs to convert it to SiLK flow records for analysis. The pcap file is large (10 GB), and the analyst wants to minimize the time and disk usage. Which approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.