NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which NetFlow indicator is commonly associated with data exfiltration?

   • AA large volume of outbound traffic to an external IP address during off-hours
   • BA decrease in the total number of flows on the network
   • CA high number of inbound connections from a single external IP
   • DAn increase in DNS queries to internal servers
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During an incident investigation, an analyst reviews NetFlow records and identifies a large data transfer from an internal database server to an external IP address on TCP port 443. The NetFlow data shows the transfer occurred over a 30-minute window. To determine whether the transfer was legitimate encrypted backup or malicious data exfiltration, which additional data source would provide the most useful corroborating evidence?

   • AFirewall logs showing the connection attempt
   • BFull packet capture of the session
   • CDNS logs for the external domain
   • DAuthentication logs from the database server
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An analyst is monitoring NetFlow data and observes a sudden increase in UDP traffic to a single external IP address on port 53 from many internal hosts. The flow records show a high packet count but very low bytes per packet. Which attack is most likely occurring?

   • APort scan
   • BTCP SYN flood
   • CData exfiltration via DNS tunneling
   • DDNS amplification DDoS attack
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst notices a NetFlow record showing a single internal host sending 500-byte UDP packets to destination port 53 on 50 different external IPs within 2 seconds, each flow lasting under 1 second. Which attack pattern does this most strongly suggest?

   • AFast-flux DNS tunneling
   • BDNS amplification DDoS attack
   • CDNS reconnaissance or scanning
   • DDistributed port scan
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst creates a scatter plot of NetFlow records with bytes transferred on the x-axis and flow duration on the y-axis. A cluster of points appears in the upper-right corner (high bytes, long duration). What is the most likely interpretation?

   • AThese are likely legitimate large file transfers
   • BThese are likely port scan probes
   • CThese are likely dropped packets
   • DThese are likely DNS queries
   Reveal Solution Discussion Select an answer first