You need to capture network traffic on a Linux interface for later analysis, but you want to avoid capturing unnecessary traffic and ensure the capture file is not too large. Which tcpdump command is most appropriate?

tcpdump -i eth0 -s 0 -w capture.pcap

tcpdump -i eth0 -c 1000 -w capture.pcap

tcpdump -i eth0 -w capture.pcap 'port 80 or port 443'

tcpdump -i eth0 -n -w capture.pcap

A SIEM alert shows a workstation making outbound connections to multiple external IPs on port 443, each with a different User-Agent string. The connections are short-lived and occur at random intervals. What does this pattern most likely indicate?

The workstation is performing a distributed denial-of-service attack.

The workstation is running a legitimate update service.

The workstation is part of a botnet using multiple C2 servers to evade detection.

The user is browsing the web normally.

You are correlating logs from a firewall, an IDS, and a web server. The firewall log shows a connection from an external IP to the web server on port 80. The IDS log shows an alert for 'SQL injection' at the same time. The web server log shows a request with a 'UNION SELECT' statement. What is the most likely conclusion?

The web server is compromised and data was exfiltrated

The IDS generated a false positive

An attacker attempted SQL injection against the web server

GIAC Certified Incident Handler

Domain 1Objective 2

Network and Log Investigations GCIH Practice Questions (Page 6)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 26–30

26application · medium
You need to capture network traffic on a Linux interface for later analysis, but you want to avoid capturing unnecessary traffic and ensure the capture file is not too large. Which tcpdump command is most appropriate?
Select an answer first
27foundation · easy
An analyst sees a log entry showing a successful login from a user account that has not been used in six months, followed by a series of failed login attempts for other accounts from the same source IP. Which attacker activity is most likely indicated?
Select an answer first
28foundation · easy
Which command-line tool is commonly used to capture network packets on a Linux system?
Select an answer first
29expert · hard
A SIEM alert shows a workstation making outbound connections to multiple external IPs on port 443, each with a different User-Agent string. The connections are short-lived and occur at random intervals. What does this pattern most likely indicate?
Select an answer first
30application · medium
You are correlating logs from a firewall, an IDS, and a web server. The firewall log shows a connection from an external IP to the web server on port 80. The IDS log shows an alert for 'SQL injection' at the same time. The web server log shows a request with a 'UNION SELECT' statement. What is the most likely conclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Network and Log Investigations GCIH Practice Questions (Page 6)

Questions 26–30

You need to capture network traffic on a Linux interface for later analysis, but you want to avoid capturing unnecessary traffic and ensure the capture file is not too large. Which tcpdump command is most appropriate?

An analyst sees a log entry showing a successful login from a user account that has not been used in six months, followed by a series of failed login attempts for other accounts from the same source IP. Which attacker activity is most likely indicated?

Which command-line tool is commonly used to capture network packets on a Linux system?

A SIEM alert shows a workstation making outbound connections to multiple external IPs on port 443, each with a different User-Agent string. The connections are short-lived and occur at random intervals. What does this pattern most likely indicate?

Keep studying — Incident Response and Investigation