A large enterprise is deploying SiLK to analyze network flows from multiple routers. The team needs to ensure that flow data from different routers is stored in a way that allows them to distinguish the source router when querying. They also need to be able to filter by router later. Which SiLK component and configuration is required?

Run a separate SiLK repository for each router and merge queries manually.

Use rwptoflow to convert router exports and manually tag each record with a custom field.

Store all flows in a single file and use the router IP address as a filter field.

Configure each router to send flows to a separate SiLK sensor, and use the sensor ID in rwfilter queries.

An analyst is examining a SiLK flow record and sees the following fields: sIP=10.0.0.5, dIP=8.8.8.8, sPort=12345, dPort=53, protocol=17, packets=10, bytes=500. What does this record indicate?

A UDP HTTP request from 10.0.0.5 to 8.8.8.8

A TCP DNS query from 10.0.0.5 to 8.8.8.8

A TCP connection from 8.8.8.8 to 10.0.0.5

A UDP DNS query from 10.0.0.5 to 8.8.8.8

How does SiLK typically collect network flow data from routers and sensors?

By installing agents on every host to report connections

By capturing packets with tcpdump and storing them directly

By performing deep packet inspection on every packet

By reading NetFlow or IPFIX records exported from network devices

What type of output does rwipview produce?

A graphical visualization of IP-to-IP traffic

A text-based list of top talkers

GIAC Certified Intrusion Analyst

Domain 2Objective 2

SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 8)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

16concepts

Questions 36–40

36expert · hard
A large enterprise is deploying SiLK to analyze network flows from multiple routers. The team needs to ensure that flow data from different routers is stored in a way that allows them to distinguish the source router when querying. They also need to be able to filter by router later. Which SiLK component and configuration is required?
Select an answer first
37foundation · easy
What type of input file does rwptoflow accept?
Select an answer first
38application · medium
An analyst is examining a SiLK flow record and sees the following fields: sIP=10.0.0.5, dIP=8.8.8.8, sPort=12345, dPort=53, protocol=17, packets=10, bytes=500. What does this record indicate?
Select an answer first
39foundation · easy
How does SiLK typically collect network flow data from routers and sensors?
Select an answer first
40foundation · easy
What type of output does rwipview produce?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

SiLK and Other Traffic Analysis Tools GCIA Practice Questions (Page 8)

Questions 36–40

What type of input file does rwptoflow accept?

An analyst is examining a SiLK flow record and sees the following fields: sIP=10.0.0.5, dIP=8.8.8.8, sPort=12345, dPort=53, protocol=17, packets=10, bytes=500. What does this record indicate?

How does SiLK typically collect network flow data from routers and sensors?

What type of output does rwipview produce?

Keep studying — Traffic Analysis and Tools