An analyst is reviewing network flows and sees a large number of connections from a single internal IP to many different external IPs on port 25 (SMTP). The internal IP is a user workstation. Which hypothesis is most likely?

The workstation is downloading email from a mail server.

The workstation is backing up data to a cloud service.

The workstation is performing a port scan.

The workstation is sending spam or phishing emails.

An analyst is investigating a potential malware infection and has a pcap file. The analyst notices that the malware is using a non-standard port for HTTP traffic (port 8080). The analyst wants to identify all HTTP requests and responses in the pcap, regardless of the port. Which approach is most effective?

Use tshark with the -d option to decode port 8080 as HTTP

Use a custom script to parse the pcap for HTTP signatures

Use tcpdump to filter for port 8080 and view the raw packets

Use Wireshark's 'Decode As' feature to decode port 8080 as HTTP

A security analyst is reviewing NetFlow data and notices that a server in the internal network is communicating with an external IP address on port 445 (SMB) at a steady rate of 1 Mbps. The server is a web server and does not normally use SMB. The analyst suspects data exfiltration. What is the most effective way to confirm the exfiltration?

Capture and inspect the SMB traffic to see if files are being transferred

Block the external IP address in the firewall

Check the server's system logs for any SMB-related events

Use a flow analysis tool to identify the top talkers

Which of the following is a key practice in network forensics to preserve evidence integrity?

Sharing packet captures with all team members immediately

Deleting old logs to free up storage

Recording the hash of captured packet files

Using a single tool for all analysis

GIAC Security Operations Certified

Domain 2Objective 1

Network Traffic Analysis GSOC Practice Questions (Page 3)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 11–15

11application · medium
An analyst is reviewing network flows and sees a large number of connections from a single internal IP to many different external IPs on port 25 (SMTP). The internal IP is a user workstation. Which hypothesis is most likely?
Select an answer first
12expert · hard
An analyst is investigating a potential malware infection and has a pcap file. The analyst notices that the malware is using a non-standard port for HTTP traffic (port 8080). The analyst wants to identify all HTTP requests and responses in the pcap, regardless of the port. Which approach is most effective?
Select an answer first
13foundation · easy
Which type of analysis involves looking for specific byte sequences or patterns in packet payloads to detect known malware?
Select an answer first
14expert · hard
A security analyst is reviewing NetFlow data and notices that a server in the internal network is communicating with an external IP address on port 445 (SMB) at a steady rate of 1 Mbps. The server is a web server and does not normally use SMB. The analyst suspects data exfiltration. What is the most effective way to confirm the exfiltration?
Select an answer first
15foundation · easy
Which of the following is a key practice in network forensics to preserve evidence integrity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Network Traffic Analysis GSOC Practice Questions (Page 3)

Questions 11–15

An analyst is reviewing network flows and sees a large number of connections from a single internal IP to many different external IPs on port 25 (SMTP). The internal IP is a user workstation. Which hypothesis is most likely?

Which type of analysis involves looking for specific byte sequences or patterns in packet payloads to detect known malware?

Which of the following is a key practice in network forensics to preserve evidence integrity?

Keep studying — Network and Event Analysis