NetFlow Analysis and Attack Visualization GNFA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   NetFlow shows a single internal host communicating with an external IP on TCP port 443 at a steady 2 Mbps for 6 hours. The host's firewall logs show no blocked outbound connections, and the destination IP is not on any threat intel list. Which additional data source would most efficiently determine if this is data exfiltration or benign HTTPS traffic?

   • ANetFlow records with packet size distribution
   • BProxy logs with TLS SNI and user identity
   • CFull packet capture of the session
   • DRouter interface counters
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A NetFlow analyst visualizes outbound traffic from a single workstation and sees a 'fan-out' pattern: one source IP connecting to hundreds of destination IPs, each on port 445, with very few packets per flow. Which conclusion is best supported?

   • AThe workstation is exfiltrating data via SMB
   • BThe workstation is performing a legitimate software update check
   • CThe workstation is a victim of a DDoS attack
   • DThe workstation is conducting a horizontal port scan
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following fields is typically included in a NetFlow record?

   • ASource and destination IP addresses
   • BThe contents of HTTP requests and responses
   • CFull packet payload data
   • DThe complete TCP handshake packets
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When analyzing NetFlow data, what does an unusually high number of flows to a single destination port on many different hosts suggest?

   • AA data exfiltration attempt using DNS tunneling
   • BA distributed denial-of-service (DDoS) attack using ICMP flood
   • CA horizontal port scan or a worm propagation attempt
   • DA normal software update distribution
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A network forensic analyst has completed a NetFlow analysis that identified a compromised host exfiltrating data to an external IP. The analyst must present the findings to a non-technical executive board. Which approach best communicates the findings effectively?

   • ARecommend immediate action without providing visual evidence
   • BProvide a detailed technical report with packet captures and malware analysis
   • CPresent a high-level summary with a simple graph showing outbound traffic spikes and a clear statement of the risk
   • DShow raw NetFlow records and explain each field in detail
   Reveal Solution Discussion Select an answer first