An analyst is reviewing a pcap file and notices a series of ICMP Echo Request packets sent to a broadcast address (e.g., 192.168.1.255). The source IP is spoofed. What is the most likely purpose of this traffic?

A normal network diagnostic tool

What is a network flow record?

A full packet capture of all traffic on a network segment

A list of all open ports on a server

A log of all DNS queries made by a host

A summary of communication between two endpoints, including metadata such as IPs, ports, and byte counts

During a forensic investigation, an analyst needs to determine if a file was exfiltrated from an internal server to an external host. The analyst has NetFlow logs and a partial packet capture that includes the beginning of the TCP session. Which technique would be most useful to estimate the amount of data transferred?

Check the server's file system for the file's size.

Analyze the TCP sequence numbers in the partial capture to calculate the total bytes.

Use NetFlow byte counts for the session to the external IP.

Look at the firewall logs for the session duration.

A security analyst is investigating a potential data exfiltration and has NetFlow logs showing a large outbound transfer to an external IP. The analyst also has a partial packet capture that includes the beginning of the session. The analyst needs to determine if the transfer contained sensitive data. Which technique would be most effective?

Inspect the partial packet capture for any unencrypted data that might indicate the type of content.

Use NetFlow logs to determine the exact file size transferred.

Check the external IP's reputation to infer if it is a known data storage service.

Look at the server's application logs to see if any file was accessed.

GIAC Security Operations Certified

Domain 2Objective 1

Network Traffic Analysis GSOC Practice Questions (Page 4)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 16–20

16application · medium
An analyst is reviewing a pcap file and notices a series of ICMP Echo Request packets sent to a broadcast address (e.g., 192.168.1.255). The source IP is spoofed. What is the most likely purpose of this traffic?
Select an answer first
17foundation · easy
What is a network flow record?
Select an answer first
18application · medium
During a forensic investigation, an analyst needs to determine if a file was exfiltrated from an internal server to an external host. The analyst has NetFlow logs and a partial packet capture that includes the beginning of the TCP session. Which technique would be most useful to estimate the amount of data transferred?
Select an answer first
19expert · medium
A security analyst is investigating a potential data exfiltration and has NetFlow logs showing a large outbound transfer to an external IP. The analyst also has a partial packet capture that includes the beginning of the session. The analyst needs to determine if the transfer contained sensitive data. Which technique would be most effective?
Select an answer first
20foundation · easy
A security analyst needs to capture network traffic on a Linux interface for later analysis. Which command-line tool is specifically designed for packet capture and can write the captured packets to a file for offline review?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Network Traffic Analysis GSOC Practice Questions (Page 4)

Questions 16–20

An analyst is reviewing a pcap file and notices a series of ICMP Echo Request packets sent to a broadcast address (e.g., 192.168.1.255). The source IP is spoofed. What is the most likely purpose of this traffic?

What is a network flow record?

A security analyst needs to capture network traffic on a Linux interface for later analysis. Which command-line tool is specifically designed for packet capture and can write the captured packets to a file for offline review?

Keep studying — Network and Event Analysis