NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is using a NetFlow visualization tool to investigate a potential slow data exfiltration. The tool provides a time-series chart of outbound bytes per hour. The analyst notices a pattern of small, regular spikes every hour, each lasting about 5 minutes. The spikes are not present on weekends. Which interpretation is most likely?

   • AA DNS tunneling exfiltration
   • BA distributed denial-of-service attack
   • CA scheduled automated task that runs during business hours
   • DA port scan
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it beneficial to correlate NetFlow data with full packet captures (PCAP) during an investigation?

   • ATo obtain the actual payload content of suspicious flows identified in NetFlow
   • BTo reduce the storage requirements of the packet captures
   • CTo automatically block malicious traffic
   • DTo replace the need for firewall logs
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is reviewing NetFlow data and observes the following patterns: (1) a single internal host sending TCP SYN packets to many external IPs on port 445, (2) a separate internal host sending UDP packets to a single external IP on port 53 with large packet sizes, and (3) a third internal host sending continuous TCP traffic to a known malicious IP on port 443. The analyst must prioritize the incidents. Which pattern is most likely to indicate an active data exfiltration?

   • AAll three patterns are equally suspicious
   • BThe continuous TCP traffic to a known malicious IP on port 443
   • CThe TCP SYN packets to many external IPs on port 445
   • DThe UDP packets to a single external IP on port 53 with large packet sizes
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   NetFlow shows a host communicating with an external IP on TCP port 22 (SSH) for 30 minutes, transferring 500 MB. The organization's firewall logs show the connection was allowed, but the host's authentication logs show no successful SSH login. What is the most likely explanation?

   • AThe host is using SSH tunneling to exfiltrate data
   • BThe SSH traffic is encrypted and the authentication logs are incomplete
   • CThe firewall logs are incorrect
   • DThe host is performing a port scan
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   An analyst is reviewing NetFlow records and sees a flow with source IP 192.168.1.10, destination IP 10.0.0.1, source port 50000, destination port 3389, protocol TCP, and 1000 packets with 2 MB total. What is the most likely application?

   • ASMB file sharing
   • BRemote Desktop Protocol (RDP)
   • CSSH remote access
   • DHTTP web traffic
   Reveal Solution Discussion Select an answer first