A network analyst is investigating a slow file transfer over a WAN link. The capture shows that the TCP window size is consistently small, and the round-trip time is high. Which TCP mechanism is most likely limiting throughput?

TCP is using selective acknowledgments (SACK), which reduces throughput.

TCP is using the Nagle algorithm, which delays ACKs and reduces throughput.

TCP is using a fixed window size of 64 KB, which is optimal for high-latency links.

TCP window scaling is not enabled, limiting the receive window to 64 KB.

A company is designing a network for a data center that requires high availability and fault tolerance. They are considering a full mesh topology among four core switches. What is the primary trade-off of this design?

Lower cost but reduced fault tolerance.

Increased redundancy but higher cost and complexity due to the number of links.

Reduced latency but increased risk of broadcast storms.

Simplified troubleshooting but limited scalability.

A network analyst is troubleshooting a performance issue. A packet capture shows that a client is sending TCP SYN packets repeatedly to a server, but the server is not responding with SYN-ACK. The analyst confirms that the server is up and the application is listening. Which of the following is the most likely cause?

A firewall is dropping the SYN packets before they reach the server.

The server is out of TCP ports.

The server's ARP cache is full.

The client is using the wrong destination MAC address.

GIAC Network Forensic Analyst

Domain 1Objective 2

Network Architecture GNFA Practice Questions (Page 1)

Part of the Network Fundamentals and Architecture domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 1–5

1foundation · easy
Which network device forwards data frames based on MAC addresses and operates at Layer 2 of the OSI model?
Select an answer first
2expert · hard
A network analyst is investigating a slow file transfer over a WAN link. The capture shows that the TCP window size is consistently small, and the round-trip time is high. Which TCP mechanism is most likely limiting throughput?
Select an answer first
3expert · hard
A company is designing a network for a data center that requires high availability and fault tolerance. They are considering a full mesh topology among four core switches. What is the primary trade-off of this design?
Select an answer first
4foundation · easy
Which network topology provides the highest level of redundancy because every device has a direct connection to every other device?
Select an answer first
5expert · medium
A network analyst is troubleshooting a performance issue. A packet capture shows that a client is sending TCP SYN packets repeatedly to a server, but the server is not responding with SYN-ACK. The analyst confirms that the server is up and the application is listening. Which of the following is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Network Architecture GNFA Practice Questions (Page 1)

Questions 1–5

Which network device forwards data frames based on MAC addresses and operates at Layer 2 of the OSI model?

A network analyst is investigating a slow file transfer over a WAN link. The capture shows that the TCP window size is consistently small, and the round-trip time is high. Which TCP mechanism is most likely limiting throughput?

A company is designing a network for a data center that requires high availability and fault tolerance. They are considering a full mesh topology among four core switches. What is the primary trade-off of this design?

Which network topology provides the highest level of redundancy because every device has a direct connection to every other device?

Keep studying — Network Fundamentals and Architecture