In a scatter plot of NetFlow data where each point represents a flow, what would a cluster of points with the same destination IP but varying source IPs indicate?

A single host communicating with many servers

Many hosts communicating with a single destination, possibly indicating a DDoS or a popular service

A data exfiltration attempt from a single host

A network misconfiguration causing duplicate flows

Which of the following tools is commonly used to create visualizations from NetFlow data?

ELK Stack (Elasticsearch, Logstash, Kibana)

A NetFlow analyst wants to visualize the relationship between internal hosts and external IPs to identify which hosts are communicating with the most external destinations. Which visualization is best suited?

A time-series line chart of flows per minute

A bar chart of total bytes per internal host

A node-link diagram with internal hosts on one side and external IPs on the other

An analyst is investigating a potential data breach and has NetFlow records showing a large outbound transfer from a file server to an external IP. To determine if the transfer contained sensitive data, which additional data source would be most valuable?

DNS logs for the external domain

File server audit logs showing file access and copy operations

Firewall logs showing the connection

A network analyst is using a NetFlow visualization tool and sees a scatter plot where each point represents a flow, with the x-axis representing time and the y-axis representing bytes per flow. The analyst notices a cluster of points at a consistent time each day with high byte counts. What is the most likely interpretation?

A distributed denial-of-service attack

A scheduled backup or data transfer occurring daily

GIAC Network Forensic Analyst

Domain 2Objective 1

NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 8)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 36–40

36foundation · easy
In a scatter plot of NetFlow data where each point represents a flow, what would a cluster of points with the same destination IP but varying source IPs indicate?
Select an answer first
37foundation · easy
Which of the following tools is commonly used to create visualizations from NetFlow data?
Select an answer first
38application · medium
A NetFlow analyst wants to visualize the relationship between internal hosts and external IPs to identify which hosts are communicating with the most external destinations. Which visualization is best suited?
Select an answer first
39application · medium
An analyst is investigating a potential data breach and has NetFlow records showing a large outbound transfer from a file server to an external IP. To determine if the transfer contained sensitive data, which additional data source would be most valuable?
Select an answer first
40application · medium
A network analyst is using a NetFlow visualization tool and sees a scatter plot where each point represents a flow, with the x-axis representing time and the y-axis representing bytes per flow. The analyst notices a cluster of points at a consistent time each day with high byte counts. What is the most likely interpretation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.