GIAC Network Forensic Analyst (GNFA) - GNFA Exam Questions [2026]

QUESTION NO: 1
Which of the following are security risks associated with FTP?
(Select two.)
Response:

A. It is limited to local file transfers only B. Data is transmitted in plaintext C. It lacks built-in encryption D. It is a UDP-based protocol

Correct Answer: B,C

QUESTION NO: 2
What methods are used to identify the structure of an unknown network protocol?
(Select two.)
Response:

A. Watching video tutorials B. Packet inspection C. Reverse engineering binaries D. Static code analysis

Correct Answer: B,C

QUESTION NO: 3
An attacker intercepts a legitimate communication session and inserts malicious commands while appearing as a trusted participant. Which protocol is most vulnerable to this attack due to its lack of encryption?
Response:

A. SFTP B. HTTPS C. FTP D. SSH

Correct Answer: C

QUESTION NO: 4
What is a common attack technique used to intercept wireless network traffic?
Response:

A. Man-in-the-Middle (MITM) B. ARP Spoofing C. DNS Tunneling D. Cross-Site Scripting (XSS)

Correct Answer: A

QUESTION NO: 5
Which transport layer protocol is best suited for applications requiring low latency but does not guarantee packet delivery?
Response:

A. ICMP B. UDP C. SCTP D. TCP

Correct Answer: B

QUESTION NO: 6
Which of the following best describes an SIEM (Security Information and Event Management) system?
Response:

A. A device that encrypts all logs for security purposes B. A tool that blocks malicious network traffic C. A firewall rule enforcement mechanism D. A system that collects, normalizes, and analyzes security logs

Correct Answer: D

QUESTION NO: 7
What is a key advantage of using 802.1X authentication for wireless security?
Response:

A. It reduces the need for network segmentation B. It enables encrypted authentication for each user C. It allows access to anyone with a Wi-Fi password D. It prevents rogue access points from appearing

Correct Answer: B

QUESTION NO: 8
What is the primary purpose of a VLAN in network architecture?
Response:

A. To encrypt network traffic B. To replace firewalls in enterprise environments C. To logically segment networks without requiring physical separation D. To increase network speed

Correct Answer: C

QUESTION NO: 9
Which of the following protocols provides secure file transfers by encrypting data during transmission?
Response:

A. SFTP B. Telnet C. FTP D. HTTP

Correct Answer: A

QUESTION NO: 10
Which of the following are features of a forward proxy?
(Select two.)
Response:

A. Protects internal servers from direct exposure B. Functions only at the transport layer C. Filters outgoing client requests D. Caches frequently accessed web content

Correct Answer: C,D