Which NetFlow analysis technique would be most effective for detecting a distributed port scan?

Looking for a single source IP with many flows to different destination ports on the same target

Looking for a single flow with a large byte count

Looking for many source IPs each sending a small number of flows to the same destination port on a target

Looking for flows with a duration longer than 24 hours

In a typical NetFlow deployment, what role does the 'collector' play?

It analyzes traffic in real time and blocks malicious flows

It receives and stores flow records exported by network devices

It provides the user interface for configuring routers

It generates flow records from sampled packets

When interpreting a time series graph of NetFlow data, what does a sudden, sharp spike in traffic to a single destination port indicate?

A potential port scan or denial-of-service attack targeting that port

A normal increase in user activity

What is the primary purpose of NetFlow in network traffic analysis?

To replace firewall and intrusion detection systems by actively blocking malicious traffic

To encrypt all network traffic to ensure confidentiality of data in transit

To provide a summarized record of traffic flows, enabling visibility into communication patterns without storing full packet contents

To capture and store the full content of every packet traversing the network

An analyst is using a NetFlow visualization tool to identify hosts that are communicating with a known malicious IP address. The tool provides several visualization options. Which visualization would most efficiently reveal all internal hosts that have flows to the malicious IP?

A line chart of total traffic over time

A pie chart of traffic by protocol

A bar chart of top source IPs by total bytes

A table sorted by destination IP, filtered to the malicious IP

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 5)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 21–25

21foundation · easy
Which NetFlow analysis technique would be most effective for detecting a distributed port scan?
Select an answer first
22foundation · easy
In a typical NetFlow deployment, what role does the 'collector' play?
Select an answer first
23foundation · easy
When interpreting a time series graph of NetFlow data, what does a sudden, sharp spike in traffic to a single destination port indicate?
Select an answer first
24foundation · easy
What is the primary purpose of NetFlow in network traffic analysis?
Select an answer first
25application · medium
An analyst is using a NetFlow visualization tool to identify hosts that are communicating with a known malicious IP address. The tool provides several visualization options. Which visualization would most efficiently reveal all internal hosts that have flows to the malicious IP?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.