An analyst is using a NetFlow visualization tool to investigate a potential DDoS attack. The tool can generate various charts. Which visualization would most quickly reveal the scale and source distribution of the attack?

A pie chart of traffic by protocol

A table of flows sorted by destination port

A line chart of total traffic over time

A bar chart of top source IPs by packet count

Which NetFlow metric pattern is most indicative of a DDoS (Distributed Denial of Service) attack?

A sudden, massive increase in the number of flows or packets to a single target from many sources

An increase in the average packet size of all flows

A single flow with a very long duration

A gradual decrease in overall network traffic

A network analyst needs to present NetFlow data to management to show a gradual increase in outbound traffic over the past month, likely indicating data exfiltration. Which type of visualization would best communicate this trend over time?

A pie chart of traffic by protocol

A line chart of outbound bytes over time

A scatter plot of packet size versus time

A bar chart of top talkers by total bytes

A NetFlow analyst notices a sudden increase in flows from many external IPs to a single internal server on TCP port 443, each flow with 1-2 packets and no response flows. What does this pattern most likely indicate?

A legitimate spike in web traffic

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 10)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 46–50

46application · medium
An analyst is using a NetFlow visualization tool to investigate a potential DDoS attack. The tool can generate various charts. Which visualization would most quickly reveal the scale and source distribution of the attack?
Select an answer first
47foundation · easy
Which additional data source would be most useful to confirm whether a NetFlow-detected spike in outbound traffic is malicious?
Select an answer first
48foundation · easy
Which NetFlow metric pattern is most indicative of a DDoS (Distributed Denial of Service) attack?
Select an answer first
49application · medium
A network analyst needs to present NetFlow data to management to show a gradual increase in outbound traffic over the past month, likely indicating data exfiltration. Which type of visualization would best communicate this trend over time?
Select an answer first
50application · medium
A NetFlow analyst notices a sudden increase in flows from many external IPs to a single internal server on TCP port 443, each flow with 1-2 packets and no response flows. What does this pattern most likely indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.