A NetFlow analyst wants to create a visualization that shows the top 10 source IPs by total bytes for a specific time period. Which chart type is most appropriate?

A horizontal bar chart sorted by bytes

A network administrator is configuring NetFlow export on a router. The router is connected to a core switch that aggregates traffic from multiple VLANs. The administrator wants to ensure that NetFlow data is collected for all traffic passing through the router, including traffic between VLANs. What is the most important configuration step?

Configure the NetFlow collector IP address and port

Enable NetFlow on all router interfaces that carry traffic

Increase the NetFlow cache size

In the context of network traffic analysis, what is a 'flow' as defined by NetFlow?

A unidirectional sequence of packets sharing the same source IP, destination IP, source port, destination port, and protocol

A collection of all packets sent by a single application over a long period

A bidirectional conversation between two hosts, regardless of ports or protocol

A single packet transmitted from one host to another

What is a key element of an effective NetFlow analysis report for management?

Focusing solely on the tools used for analysis

Using technical jargon to demonstrate expertise

Including every flow record in an appendix

Providing a clear executive summary with key findings, impact, and recommended actions

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 4)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 16–20

16application · easy
A NetFlow analyst wants to create a visualization that shows the top 10 source IPs by total bytes for a specific time period. Which chart type is most appropriate?
Select an answer first
17application · medium
A network administrator is configuring NetFlow export on a router. The router is connected to a core switch that aggregates traffic from multiple VLANs. The administrator wants to ensure that NetFlow data is collected for all traffic passing through the router, including traffic between VLANs. What is the most important configuration step?
Select an answer first
18application · medium
An analyst is reviewing NetFlow data and notices that a single internal host is communicating with many external IP addresses on port 53 (DNS) but the flow records show unusually large packet sizes for DNS queries. The analyst suspects DNS tunneling. Which NetFlow field would be most useful to confirm this suspicion?
Select an answer first
19foundation · easy
In the context of network traffic analysis, what is a 'flow' as defined by NetFlow?
Select an answer first
20foundation · easy
What is a key element of an effective NetFlow analysis report for management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 4)

Questions 16–20

A NetFlow analyst wants to create a visualization that shows the top 10 source IPs by total bytes for a specific time period. Which chart type is most appropriate?

In the context of network traffic analysis, what is a 'flow' as defined by NetFlow?

What is a key element of an effective NetFlow analysis report for management?

Keep studying — Network Traffic Analysis and Visualization