GIAC GNFA Certification Sample Questions

GNFA Dumps, GNFA PDF, GNFA VCE, GIAC Network Forensic Analyst VCE, GIAC GNFA PDF The purpose of this Sample Question Set is to provide you with information about the GIAC Network Forensic Analyst (GNFA) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GNFA certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GNFA Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Network Forensic Analyst (GNFA) certification exam.

These sample questions are simple and basic questions that represent likeness to the real GIAC Network Forensic Analyst exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GNFA Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.

GIAC GNFA Sample Questions:

01. Memory analysis of a manufacturer's engineering workstation shows that powershell.exe -NoProfile -EncodedCommand ran with a long Base64 argument. The Windows logs forwarded to the SIEM hold no trace of it, because only logon and account-management auditing were enabled. The team is choosing what to add so the next such execution is recorded with its content.

Which settings should they enable?

(Choose two.)

a) PowerShell script block logging, which records the script text as the engine runs it

b) Windows Firewall logging, which records each connection the host allowed or dropped

c) Process creation auditing with command-line capture, which logs event 4688 with the full arguments

d) Object access auditing on the user profile folder, which records file reads and writes

02. After an evil-twin incident at an insurance firm, the analyst finds that laptops on the WPA2-Enterprise network use PEAP with MSCHAPv2. Several completed the inner authentication against the attacker's RADIUS server, which presented a self-signed certificate.

Which control would have stopped those laptops from sending credentials to the fake network?

a) Enabling 802.11w management frame protection on the corporate access points and controllers

b) Shortening the RADIUS session timeout so that captured credential exchanges expire sooner

c) Moving the corporate SSID to the 5 GHz band and disabling every 2.4 GHz radio

d) Enforcing server-certificate validation on every client

03. Flow records from a hospital's internet edge show inbound TCP sessions from many external addresses to a clinical server on destination port 3389.

Which service is exposed to the internet?

a) Windows Remote Management (WinRM) over HTTP

b) Remote Desktop Protocol (RDP)

c) Secure Shell (SSH)

d) Virtual Network Computing (VNC) remote access

04. A manufacturer's plant WLAN runs WPA2-Personal with Protected Management Frames enabled. An authorized assessment reports that one four-way handshake, recorded passively from the air, was enough to recover the weak passphrase by offline guessing.

Which change most directly removes the exposure the report describes?

a) Rotate the pre-shared key every quarter and send the new value to staff through the maintenance ticketing system

b) Hide the SSID and restrict associations by client MAC

c) Move the plant WLAN to WPA3-Personal in SAE-only mode, which resists offline dictionary guessing

d) Require CCMP instead of TKIP on every plant access point

05. During an audit of a city council's wireless estate, an examiner records this airodump-ng row for the staff network:

BSSID 00:1a:2b:11:22:33 PWR -41 CH 6 ENC WPA2 CIPHER CCMP AUTH PSK ESSID CC-Staff

Which two conclusions does this row support?

(Choose two.)

a) The access point sits on channel 41, which places it in the 5 GHz band

b) The network protects its data frames with TKIP, the legacy WPA cipher

c) Staff join with a shared pre-shared key rather than individual 802.1X logins

d) Data frames on this network are protected with CCMP, which uses AES

06. An airline's booking site is published through a reverse proxy that terminates TLS and balances requests across six application servers over plain HTTP. No TLS session keys were retained, and the proxy negotiates only ECDHE key exchange. Investigators need the exact paths and query strings an attacker sent, and which server to image.

Which statements about the available evidence are accurate?

(Choose two.)

a) The edge router's flow records can show which application server handled each request, since each flow names its endpoints

b) The reverse proxy's access log can hold the path and query string, as the proxy decrypts each session

c) A capture from the internet side can reveal the paths once the proxy's private key is obtained from the server

d) The reverse proxy's log can name the server each request was forwarded to, identifying the one to image

07. Guests on one floor of a hotel keep losing Wi-Fi for a few seconds at a time. Before choosing a fix, the network engineer must decide whether the cause is RF interference or forged deauthentication, and gathers a monitor-mode capture and client event logs.

Which two observations support deauthentication rather than interference?

(Choose two.)

a) Bursts of deauthentication frames to the broadcast address just before each drop

b) Client event logs recording each disconnect as a deauthentication received from the AP

c) Beacons from the floor's access point missing from the capture throughout each outage

d) A rising noise floor and high retry rates on the floor's channel during each outage

08. At a city council, 40 staff work through two shared remote desktop servers, so every web request in the forward proxy's access log comes from one of just two client addresses. Investigators need future entries to show which staff member made each request.

Which change achieves that?

a) Require proxy authentication so entries record the username

b) Move the proxy to transparent interception mode at the gateway

c) Log the X-Forwarded-For header that each request carries to the proxy

d) Correlate proxy entries with DHCP lease logs

09. Workstations at a utility send web traffic to an explicitly configured forward proxy at 10.1.1.5. During a hunt, the internal DNS resolver's query log shows only 10.1.1.5 looking up bad.example.net, although the proxy log shows three workstations requesting it.

Why do the workstations not appear in the resolver log?

a) The workstations cached the answer from an earlier lookup

b) The resolver logs each name once

c) The proxy rewrites the source address of workstation DNS queries

d) The proxy performs lookups for its clients

10. Threat intelligence reports that 198.51.100.77 served as a command-and-control address last month. A regional bank's analyst queries the flow collector for that period and finds no record of any internal host contacting it. The bank's edge exporters apply 1-in-1,000 packet sampling. The incident manager wants to close the question as "no contact".

Which conclusion does this evidence support?

a) No internal host contacted the address, because every connection produces at least one flow record

b) The absence proves little, because sampling can miss short connections entirely, so an unsampled source such as firewall or DNS resolver logs must be checked before closing

c) The address was contacted, but the collector discarded those records after they fell below the sampling threshold

d) Multiply the zero result by the sampling rate to estimate the true number of connections

Answers:

Question: 01 Answer: a, c	Question: 02 Answer: d	Question: 03 Answer: b	Question: 04 Answer: c	Question: 05 Answer: c, d
Question: 06 Answer: b, d	Question: 07 Answer: a, b	Question: 08 Answer: a	Question: 09 Answer: d	Question: 10 Answer: b

Note: For any error in GIAC Network Forensic Analyst (GNFA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.