When reconstructing a timeline of an incident, what is the primary purpose of correlating logs from different sources?

To calculate the total number of logs

To identify the order of events across systems

To determine the attacker's identity

To verify the accuracy of each log source

You have a large packet capture file (2 GB) and need to quickly extract all HTTP requests that contain the string 'admin' in the URI. Which tool and command would be most efficient?

Use tcpdump to read the file and filter for port 80, then grep for 'admin'

Use Wireshark's display filter 'http.request.uri contains "admin"'

Use strings on the capture file and grep for 'admin'

Use tshark with the filter 'http.request.uri contains "admin"'

You are analyzing a pcap file to identify the payload of an HTTP POST request that may contain stolen data. Which Wireshark feature should you use to quickly extract the full HTTP request and its body?

Display filter 'http.request.method == POST'

GIAC Certified Incident Handler

Domain 1Objective 2

Network and Log Investigations GCIH Practice Questions (Page 1)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 1–5

1foundation · easy
When reconstructing a timeline of an incident, what is the primary purpose of correlating logs from different sources?
Select an answer first
2foundation · easy
A firewall log shows a large outbound transfer from an internal server to an external IP address on port 443 during off-hours, and the server has no business reason to communicate with that IP. Which attacker activity is most likely indicated?
Select an answer first
3application · medium
You have a large packet capture file (2 GB) and need to quickly extract all HTTP requests that contain the string 'admin' in the URI. Which tool and command would be most efficient?
Select an answer first
4foundation · easy
During a packet capture review, an analyst observes a series of TCP SYN packets sent to consecutive IP addresses on the same subnet, each followed by a TCP RST or no response. Which type of activity does this pattern most likely indicate?
Select an answer first
5application · medium
You are analyzing a pcap file to identify the payload of an HTTP POST request that may contain stolen data. Which Wireshark feature should you use to quickly extract the full HTTP request and its body?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Network and Log Investigations GCIH Practice Questions (Page 1)

Questions 1–5

When reconstructing a timeline of an incident, what is the primary purpose of correlating logs from different sources?

A firewall log shows a large outbound transfer from an internal server to an external IP address on port 443 during off-hours, and the server has no business reason to communicate with that IP. Which attacker activity is most likely indicated?

You have a large packet capture file (2 GB) and need to quickly extract all HTTP requests that contain the string 'admin' in the URI. Which tool and command would be most efficient?

During a packet capture review, an analyst observes a series of TCP SYN packets sent to consecutive IP addresses on the same subnet, each followed by a TCP RST or no response. Which type of activity does this pattern most likely indicate?

You are analyzing a pcap file to identify the payload of an HTTP POST request that may contain stolen data. Which Wireshark feature should you use to quickly extract the full HTTP request and its body?

Keep studying — Incident Response and Investigation