An analyst needs to report a confirmed port scan to the incident response team. Which information is most important to include in the report?

The total number of flows in the entire network

The source IP, destination IPs, ports scanned, and timestamps

The name of the NetFlow collector

What is the primary purpose of sampling in NetFlow export?

To increase the accuracy of flow records by capturing every packet

To ensure that all flows are recorded without loss

To reduce the processing and bandwidth overhead on network devices

To encrypt flow records before transmission

When presenting NetFlow analysis findings to non-technical stakeholders, what is the most effective approach?

Focus only on the attack vector and exploit code used

Use high-level summaries and clear visualizations that highlight key findings and business impact

Explain every technical detail of the NetFlow protocol

Provide raw NetFlow export files for them to review

Why are timestamps significant in NetFlow records?

They allow the analyst to determine the exact content of the communication

They are used to encrypt the flow record

They help correlate flows with other security events and establish a timeline of activity

They identify the specific application that generated the traffic

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 2)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 6–10

6application · easy
An analyst needs to report a confirmed port scan to the incident response team. Which information is most important to include in the report?
Select an answer first
7foundation · easy
What is the primary purpose of sampling in NetFlow export?
Select an answer first
8foundation · easy
What type of visualization is often used to represent communication paths between hosts in a network?
Select an answer first
9foundation · easy
When presenting NetFlow analysis findings to non-technical stakeholders, what is the most effective approach?
Select an answer first
10foundation · easy
Why are timestamps significant in NetFlow records?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.