An analyst needs to present NetFlow data to management to show the geographic distribution of inbound attack traffic over the past month. Which visualization is most appropriate?

A world map with markers sized by attack volume

A bar chart of top source ports

A line chart of total inbound packets per day

What is the primary role of visualization in network traffic analysis?

To replace the need for packet-level analysis

To automatically block malicious traffic

To transform complex data into a format that helps analysts quickly identify patterns, trends, and anomalies

To encrypt network traffic for secure transmission

An analyst is reviewing NetFlow data and sees a flow with source IP 10.0.0.5, destination IP 8.8.8.8, source port 12345, destination port 53, protocol UDP, and 100 packets with 50,000 bytes total. What is the most likely application?

DNS tunneling or large DNS response

A forensic analyst is investigating a breach and has NetFlow records showing a large outbound transfer from a database server to an external IP. The analyst also has access to database audit logs, firewall logs, and endpoint logs. The database audit logs show that a specific user account was used to query and export a large amount of data during the same time window. The firewall logs show the connection to the external IP. The endpoint logs show that the database client application was running on the server. Which conclusion is best supported by the combined evidence?

The database server was compromised by malware

The user account was likely compromised and used to exfiltrate data

The transfer was a legitimate backup

The firewall logs are the most reliable source

A NetFlow analyst sees a flow with source port 0 and destination port 0, protocol TCP, and a single packet. What does this likely indicate?

A malformed or crafted packet used in reconnaissance

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 3)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 11–15

11application · easy
An analyst needs to present NetFlow data to management to show the geographic distribution of inbound attack traffic over the past month. Which visualization is most appropriate?
Select an answer first
12foundation · easy
What is the primary role of visualization in network traffic analysis?
Select an answer first
13application · medium
An analyst is reviewing NetFlow data and sees a flow with source IP 10.0.0.5, destination IP 8.8.8.8, source port 12345, destination port 53, protocol UDP, and 100 packets with 50,000 bytes total. What is the most likely application?
Select an answer first
14expert · hard
A forensic analyst is investigating a breach and has NetFlow records showing a large outbound transfer from a database server to an external IP. The analyst also has access to database audit logs, firewall logs, and endpoint logs. The database audit logs show that a specific user account was used to query and export a large amount of data during the same time window. The firewall logs show the connection to the external IP. The endpoint logs show that the database client application was running on the server. Which conclusion is best supported by the combined evidence?
Select an answer first
15application · medium
A NetFlow analyst sees a flow with source port 0 and destination port 0, protocol TCP, and a single packet. What does this likely indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.