A network team is deploying NetFlow collection across a large enterprise. They need to ensure that flow records are not lost if the collector fails. Which approach is most appropriate?

Configure redundant collectors with load balancing

Store flow records on the router

Increase the NetFlow export timer to reduce traffic

Use UDP for export to reduce overhead

A network analyst is examining NetFlow data and observes a single external IP address sending TCP SYN packets to multiple internal hosts across a wide range of destination ports, with no corresponding replies. The flow records show a high packet count but very low byte count per flow. Which attack pattern is best indicated by these NetFlow characteristics?

A distributed denial-of-service (DDoS) attack from many sources

Data exfiltration via DNS tunneling

An analyst must present NetFlow findings to a non-technical executive. The key finding is that a specific internal host has been exfiltrating data to an external IP. Which presentation approach is most effective?

Show a list of all flows from the host

Show a simple line chart of outbound bytes over time with an annotation at the exfiltration period

Show a raw NetFlow record table with all fields

Show a packet capture of the exfiltration session

An analyst creates a heatmap of NetFlow data with hours of the day on the x-axis and days of the week on the y-axis, colored by total bytes. The heatmap shows a bright red block every weekday from 9 AM to 5 PM. What is the most likely interpretation?

A DDoS attack occurring only during business hours

A scheduled backup running during business hours

Which type of visualization is most appropriate for showing the volume of traffic over time?

A line graph or time series chart

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 7)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 31–35

31application · medium
A network team is deploying NetFlow collection across a large enterprise. They need to ensure that flow records are not lost if the collector fails. Which approach is most appropriate?
Select an answer first
32application · medium
A network analyst is examining NetFlow data and observes a single external IP address sending TCP SYN packets to multiple internal hosts across a wide range of destination ports, with no corresponding replies. The flow records show a high packet count but very low byte count per flow. Which attack pattern is best indicated by these NetFlow characteristics?
Select an answer first
33application · easy
An analyst must present NetFlow findings to a non-technical executive. The key finding is that a specific internal host has been exfiltrating data to an external IP. Which presentation approach is most effective?
Select an answer first
34application · easy
An analyst creates a heatmap of NetFlow data with hours of the day on the x-axis and days of the week on the y-axis, colored by total bytes. The heatmap shows a bright red block every weekday from 9 AM to 5 PM. What is the most likely interpretation?
Select an answer first
35foundation · easy
Which type of visualization is most appropriate for showing the volume of traffic over time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.