Free GIAC Certified Intrusion Analyst GCIA Practice Questions

Question 1

An analyst runs tcpdump -n -S on a client's uplink and captures the start of a connection. The third segment is shown with its acknowledgment number removed.

10.1.1.20.51514 > 203.0.113.80.443: Flags [S], seq 2944051730, win 64240, options [mss 1460,sackOK,TS val 1803321 ecr 0,nop,wscale 7], length 0
203.0.113.80.443 > 10.1.1.20.51514: Flags [S.], seq 1180366102, ack 2944051731, win 65160, options [mss 1460,sackOK,TS val 99120 ecr 1803321,nop,wscale 7], length 0
10.1.1.20.51514 > 203.0.113.80.443: Flags [.], ack ??????????, win 502, length 0

Which acknowledgment number must the client's third segment carry to complete the three-way handshake?

1. 2944051731
2. 1180366103
3. 1180366102
4. 2944051732

Question 2

Sasha wants to add an entry to your DNS database for your mail server.

Which of the following types of resource records will she use to accomplish this?

1. ANAME
2. SOA
3. MX
4. CNAME

Question 3

In Wireshark 4.x an analyst applies the display filter below, intending to hide all traffic to or from 10.0.0.5.

ip.addr !== 10.0.0.5

Which packets remain displayed?

1. Only packets in which neither address is 10.0.0.5
2. Any packet with an address other than 10.0.0.5
3. No packets, because !== is not valid for address fields
4. Only packets whose source is 10.0.0.5, as !== tests the source

Question 4

Which of the following proxy servers is also referred to as transparent proxies or forced proxies?

1. Tunneling proxy server
2. Reverse proxy server
3. Anonymous proxy server
4. Intercepting proxy server

Question 5

Which of the following statements about a host-based Intrusion Detection System (HIDS) are true? Each correct answer represents a complete solution. Choose two.

1. It can detect events scattered over the network.
2. It can handle encrypted and unencrypted traffic equally.
3. It cannot detect events scattered over the network.
4. It is a technique that allows multiple computers to share one or more IP addresses.

Question 6

Victor works as a network administrator for DataSecu Inc. He uses a dual firewall Demilitarized Zone (DMZ) to insulate the rest of the network from the portions that is available to the Internet.

Which of the following security threats may occur if DMZ protocol attacks are performed?

Each correct answer represents a complete solution.

Choose all that apply.

1. Attacker can perform Zero Day attack by delivering a malicious payload that is not a part of the intrusion detection/prevention systems guarding the network.
2. Attacker can gain access to the Web server in a DMZ and exploit the database.
3. Attacker managing to break the first firewall defense can access the internal network without breaking the second firewall if it is different.
4. Attacker can exploit any protocol used to go into the internal network or intranet of the com pany

Question 7

tcpdump, run without -S, prints the following segment from the middle of an HTTP download.

203.0.113.80.80 > 10.1.1.20.51514: Flags [.], seq 1449:2897, ack 1, win 509, length 1448

Which interpretation of the seq field is correct?

1. It carries 2,897 bytes that begin at relative byte 1449 of the stream.
2. It carries relative bytes 1449 to 2897 inclusive, and the next ACK will be 2898.
3. Its values are absolute, so the server's initial sequence number was 1449.
4. It carries relative bytes 1449 to 2896 inclusive, so the next ACK will be 2897.

Question 8

Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion.

When a user visits the infected Web page, code gets automatically executed and Ryan can easily perform acts like account hijacking, history theft etc.

Which of the following types of Cross-Site Scripting attack Ryan intends to do?

1. Document Object Model (DOM)
2. Non persistent
3. SAX
4. Persistent

Question 9

Hunting for scripted clients, an analyst wants every HTTP request whose User-Agent contains the word curl in any letter case, such as curl/8.5.0 or CURL-agent. Which display filter does this?

1. http.user_agent contains "curl"
2. http.user_agent matches "(?-i)curl"
3. http.user_agent == "curl"
4. http.user_agent matches "curl"

Question 10

You are the Network Administrator for a large corporate network. You want to monitor all network traffic on your local network for suspicious activities and receive a notification when a possible attack is in process.

Which of the following actions will you take for this?

1. Enable verbose logging on the firewall
2. Install a network-based IDS
3. Install a DMZ firewall
4. Install a host-based IDS

Question 11

During an exfiltration hunt, an analyst wants outbound flow records that each carried at least 50 MB (50,000,000 bytes). Which rwfilter switch selects them?

1. --bytes=50000000
2. --bytes=0-50000000
3. --bytes=50000000-
4. --bytes-per-packet=50000000-

Question 12

A newly booted workstation broadcasts a request to dynamically obtain its IP address configuration from a server on the local subnet; to which destination port is that traffic sent?

1. TCP 161
2. UDP 69
3. TCP 21
4. UDP 67

Question 13

An analyst reviews a colleague's lab script that sends IP(dst=target)/TCP(dport=80) with no flags argument. Which TCP control flags are set in the packet that goes out?

1. Only SYN
2. Only ACK
3. SYN and ACK together
4. No flags at all

Question 14

You work as a Network Administrator for Tech Perfect Inc. Your company has a Windows 2000-based network. You want to verify the connectivity of a host in the network.

Which of the following utilities will you use?

1. PING
2. TELNET
3. NETSTAT
4. TRACERT

Question 15

An analyst has read a capture into a Scapy packet list and wants one short line per packet to scan the traffic quickly. Which call produces that?

1. pkt.show2() on the list
2. hexdump() on the list
3. ls() on the list
4. summary() on the list

Question 16

John works as a professional Ethical Hacker. He has been assigned a project for testing the security of www.we-are-secure.com. He wants to corrupt an IDS signature database so that performing attacks on the server is made easy and he can observe the flaws in the We-are-secure server. To perform his task, he first of all sends a virus that continuously changes its signature to avoid detection from IDS. Since the new signature of the virus does not match the old signature, which is entered in the IDS signature database, IDS becomes unable to point out the malicious virus.

Which of the following IDS evasion attacks is John performing?

1. Insertion attack
2. Session splicing attack
3. Evasion attack
4. Polymorphic shell code attack

Question 17

An analyst sends a single crafted stimulus with sr1() in a lab and expects to study the reply. What does sr1() return?

1. A list of sent and answered packet pairs
2. Only the one packet that answered the stimulus
3. Only the list of packets that went unanswered
4. A count of how many packets were sent

Question 18

When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as __________.

1. True negative
2. True positive
3. False negative
4. False positive

Question 19

Which of the following IPv6 address types is a single address that can be assigned to multiple interfaces?

1. Unicast
2. Anycast
3. Loopback
4. Multicast

Question 20

In which format is data encapsulated as it is handed off by the Data Link layer of the OSI model?

1. Protocols
2. Raw bits
3. Data packets
4. Data frames
5. Data segments

Question 21

Every packet from one Linux server carries IPv4 Identification 0x0000, and bytes 6 and 7 of each header are 0x4000. A new IDS rule flags the repeated ID as spoofing. How should the analyst assess the alerts?

1. Valid concern: an ID must be unique for every datagram sent
2. False positive: these are atomic datagrams, so the ID is unused
3. Valid concern: an ID of zero is reserved for crafted packets
4. Valid concern: 0x4000 marks each packet as a first fragment

Question 22

Which of the following is the default port for Hypertext Transfer Protocol (HTTP)?

1. 23
2. 21
3. 80
4. 25

Question 23

A log pipeline rewrites every IPv6 address into the RFC 5952 recommended text form so that searches match across tools. A firewall log records the source address below.

2001:0DB8:0000:0000:00A5:0000:0000:0F0F

Which string does the pipeline store?

1. 2001:db8::a5:0:0:f0f
2. 2001:db8:0:0:a5::f0f
3. 2001:db8::a5::f0f
4. 2001:DB8::A5:0:0:F0F

Question 24

Which of the following IPv4 to IPv6 transition methods uses encapsulation of IPv6 packets to traverse IPv4 networks?

1. Dual-stack
2. Translation
3. Tunneling
4. Stack

Question 25

Internal hosts use 10.0.0.0/8. An analyst wants only packets sent from an internal host to an address outside that range, to review outbound traffic. Which display filter does this?

1. ip.src == 10.0.0.0/8 && !(ip.dst == 10.0.0.0/8)
2. ip.addr == 10.0.0.0/8 && !(ip.addr == 10.0.0.0/8)
3. ip.src == 10.0.0.0 && ip.dst != 10.0.0.0
4. ip.src == 10.0.0.0/8 || ip.dst != 10.0.0.0/8

Question 26

An analyst captures the same IPv4 packet on both sides of a router that performs no NAT, does not fragment the packet and finds no IP options in it. Which header fields differ between the two captures?

1. Identification and header checksum
2. Time to Live and header checksum
3. Time to Live and Total Length
4. Identification and Time to Live

Question 27

A sensor records these packets to a Linux server (tcpdump -n -S). No other replies appear.

203.0.113.9.40210 > 10.8.0.5.22: Flags [none], seq 3110429876, win 1024, length 0
203.0.113.9.40210 > 10.8.0.5.23: Flags [none], seq 3110429876, win 1024, length 0
10.8.0.5.23 > 203.0.113.9.40210: Flags [R.], seq 0, ack 3110429876, win 0, length 0

What do the packets show about ports 22 and 23?

1. A null scan: port 22 is open or filtered and port 23 is closed
2. A null scan: port 23 is open, and port 22 is closed or filtered
3. A FIN scan: both ports are closed and the 22 reply was lost
4. A null scan: both ports are open and only port 23 logs it

Question 28

A Suricata sensor runs inline in IPS mode. Rule sid 9000200 alerts on SYN packets to the SSH server, and threshold.config contains this entry:

rate_filter gen_id 1, sig_id 9000200, track by_src, count 20, seconds 60, new_action drop, timeout 600

What does the entry do?

1. Once a source reaches 20 hits in 60 seconds, its matching traffic is dropped for 600 seconds
2. It caps the rule at 20 alerts per source each minute and discards extra alerts for 600 seconds
3. Once a source reaches 20 hits, all of its traffic to any host is blocked for 600 seconds
4. It drops the first 20 matching packets from each source per minute, then reverts to alerting

Question 29

An analyst examines the following IPv4 header from an ICMP packet.

45 00 00 54 3e 9d 40 00 40 01 0f c5 c0 a8 01 64 c6 33 64 07

How many bytes of ICMP message, header plus data, does the datagram carry?

1. 64 bytes
2. 84 bytes
3. 56 bytes
4. 76 bytes

Question 30

You are using the ping command to verify the connectivity between two hosts. You want ping to send larger sized packets than the usual 32-byte ones. Which of the following commands will you use?

1. ping -a
2. ping -4
3. ping -t
4. ping -l

Question 31

For a host to have successful Internet communication, which of the following network protocols are required? You should assume that the users will not manually configure the computer in any way and that the measure of success will be whether the user can access Web sites after powering the computer and logging on.

Each correct answer represents a complete solution.

Choose all that apply.

1. DNS
2. HTTP/HTTPS
3. DHCP
4. NTP

Question 32

In which of the following IKE phases the IPsec endpoints establish parameters for a secure ISAKMP session?

1. IKE Phase 2.5
2. IKE Phase 2
3. IKE Phase 1
4. IKE Phase 1.5

Question 33

Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?

1. tcpdump -A file_name
2. tcpdump -D file_name
3. tcpdump -X file_name
4. tcpdump -F file_name

Question 34

An analyst reviews this Zeek conn.log excerpt. The same pattern repeats for about 2,400 more lines within two minutes.

ts              id.orig_h   id.orig_p  id.resp_h   id.resp_p  proto  conn_state  history
1759310401.120  10.20.4.31  50112      10.20.8.11  445        tcp    S0          S
1759310401.121  10.20.4.31  50113      10.20.8.12  445        tcp    S0          S
1759310401.123  10.20.4.31  50114      10.20.8.13  445        tcp    S0          S
1759310401.124  10.20.4.31  50115      10.20.8.14  445        tcp    S0          S

What does this activity most likely represent?

1. A sweep for SMB listeners: SYNs to many hosts that never answered
2. Established SMB sessions to file servers that closed without any data
3. SMB connection attempts that every target host refused with a RST
4. Mid-stream SMB traffic whose handshakes began before the capture

Question 35

Which of the following is a reason to implement security logging on a DNS server?

1. For recording the number of queries resolved
2. For preventing malware attacks on a DNS server
3. For measuring a DNS server's performance
4. For monitoring unauthorized zone transfer

Question 36

Which of the following tools is used to analyze the files produced by several popular packetcapture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

1. Fpipe
2. tcptraceroute
3. Sniffer
4. tcptrace

Question 37

Two IPv4 fragments share the same ID, addresses and protocol, and each has a 20-byte header.

Frag A: offset field 0, MF=1, total length 52
Frag B: offset field 2, MF=0, total length 44

How many bytes of data do the two fragments overlap?

1. 8 bytes
2. 16 bytes
3. 24 bytes
4. 32 bytes

Question 38

An analyst crafts IP(dst='198.51.100.7')/UDP()/Raw(load=b'test') in Scapy without naming any ports. Which source and destination UDP ports does the packet use?

1. Source 20 and destination 80
2. Source 53 and destination 53
3. Source 0 and destination 0
4. Source 67 and destination 68

Question 39

Which of the following activities will you use to retrieve user names, and info on groups, shares, and services of networked computers?

1. Network tap
2. Packet crafting
3. Network mapping
4. Network enumerating

Question 40

Which of the following TCP ports are used by the FTP service? Each correct answer represents a complete solution. Choose two.

1. 80
2. 21
3. 20
4. 443

Question 41

An analyst rebuilds the IPv4 header below for a replay test and must fill in the header checksum, shown as ?? ??.

45 00 00 34 6b 2e 40 00 40 06 ?? ?? c0 a8 0a 15 cb 00 71 32

What value belongs in the checksum field?

1. 0x375a
2. 0xa5c8
3. 0xc8a5
4. 0xc8a8

Question 42

Flow records from a yaf sensor carry initial and session TCP flags. An analyst wants flows whose very first packet had both SYN and ACK set, which can indicate backscatter or a collection that began mid-handshake. Which rwfilter switch fits?

1. --flags-all=SA/SA
2. --flags-session=SA/SA
3. --syn-flag=1 --ack-flag=1
4. --flags-initial=SA/SA

Question 43

You work as a Network Administrator for a bank. For securing the bank's network, you configure a firewall and an IDS. In spite of these security measures, intruders are able to attack the network.

After a close investigation, you find that your IDS is not configured properly and hence is unable to generate alarms when needed.

What type of response is the IDS giving?

1. False Positive
2. True Negative
3. False Negative
4. True Positive

Question 44

An analyst reviewing a capture sees an IPv4 packet whose header begins with the bytes below.

46 00 00 3c

How many bytes of IP options follow the fixed portion of the header?

1. 6 bytes
2. 4 bytes
3. 24 bytes
4. 20 bytes

Question 45

Which TCP port is used by default for the Post Office Protocol version 3 (POP3) service when clients retrieve email from a mail server?

1. 21
2. 110
3. 80
4. 25

Question 46

You are concerned about outside attackers penetrating your network via your company Web server. You wish to place your Web server between two firewalls.

One firewall between the Web server and the outside world. The other between the Web server and your network.

What is this called?

1. DMZ
2. SPI firewall
3. IDS
4. Application Gateway firewall

Question 47

An analyst runs the command below, intending to stop at 06:00 on 15 September.

rwfilter --start-date=2026/09/14 --end-date=2026/09/15:06 --type=all --proto=6 --pass=tcp.rw

Which hours of repository data does rwfilter process?

1. From 00:00 on 14 September through 06:59 on 15 September
2. Every hour of both 14 September and 15 September
3. Only the 06:00 hour on each of the two days
4. From 00:00 on 14 September through 05:59 on 15 September

Question 48

Which TCP port does an FTP server use by default for its control connection, over which client commands are issued?

1. 21
2. 25
3. 23
4. 80

Question 49

A sensor on an access switch captures the following IPv6 packet: a 40-byte IPv6 header followed by an ICMPv6 message.

0000  60 00 00 00 00 10 3a 40 fe 80 00 00 00 00 00 00
0010  02 a0 c9 ff fe 14 7b 31 ff 02 00 00 00 00 00 00
0020  00 00 00 00 00 00 00 01 86 00 ef 41 40 00 07 08
0030  00 00 00 00 00 00 00 00

How should a receiving host process this message?

1. Accept it as a default router, because the source is a link-local address
2. Discard it, because a Router Advertisement must not be sent to ff02::1
3. Discard it, because a Router Advertisement must arrive with Hop Limit 255
4. Accept it, but treat the router lifetime 0x0708 as 1800 milliseconds

Question 50

Which notation is used to represent IPv6 addresses?

1. Colon-dot
2. Colon-hexadecimal
3. Hexadecimal-dot notation
4. Dot notation

Question 51

Which of the following can be monitored by using the host intrusion detection system (HIDS)?

Each correct answer represents a complete solution.

Choose two.

1. Computer performance
2. File system integrity
3. Storage space on computers
4. System files

Question 52

Which of the following terms describes an attempt to transfer DNS zone data?

1. Reconnaissance
2. Encapsulation
3. Dumpster diving
4. Spam

Question 53

A router must forward a 4,000-byte IPv4 datagram (20-byte header, no options, DF clear) onto a link with a 1,500-byte MTU, and it builds the largest fragments the link allows. What are the Fragment Offset field value and the Total Length of the third fragment?

1. Offset 2960, Total Length 1040
2. Offset 370, Total Length 1040
3. Offset 370, Total Length 1020
4. Offset 375, Total Length 1040

Question 54

You are analyzing a possibly compromised Windows host and need to identify the sessions it currently has established with remote systems. Which command-line utility displays the local host's active TCP and UDP connections?

1. PING
2. TRACERT
3. NETSTAT
4. NSLOOKUP

Question 55

A sensor records an IPv4 fragment with IHL 5, Total Length 120, MF clear and a Fragment Offset field of 0x1ffd. What is anomalous about this fragment?

1. Reassembly would produce a 65,632-byte datagram, above the 65,535 maximum
2. Its offset value 0x1ffd is not a multiple of 8, so it cannot align with others
3. A last fragment must have offset 0, so MF clear contradicts the nonzero offset
4. Its 100 data bytes are not a multiple of 8, which no fragment is allowed to have

Question 56

A firewall drops inbound TCP segments that have SYN set and ACK clear. A capture shows the first fragment of an inbound TCP datagram with IHL 5, Total Length 28, MF set and an offset of 0. Which TCP header field is missing from this fragment, letting it pass the rule?

1. Source port
2. Destination port
3. Control flags
4. Sequence number

Question 57

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple smallsized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks.

Which of the following tools can be used to perform session splicing attacks?

Each correct answer represents a complete solution.

Choose all that apply.

1. Nessus
2. Y.A.T.
3. Whisker
4. Fragroute

Question 58

Which of the following work as traffic monitoring tools in the Linux operating system?

Each correct answer represents a complete solution.

Choose all that apply.

1. MRTG
2. John the Ripper
3. IPTraf
4. Ntop

Question 59

Which of the following tools can be used for passive OS fingerprinting?

1. dig
2. nmap
3. ping
4. tcpdump

Question 60

An analyst building a lab packet with Scapy types the expression below and then serializes it to bytes.

raw(IP(dst='10.0.0.5')/TCP(dport=443))

What value does Scapy place in the IPv4 Protocol field of the resulting packet?

1. 0, the IP layer default, since it was not set
2. 1, selecting ICMP as the next header
3. 6, selecting TCP as the next header
4. 17, selecting UDP as the next header

Question 61

An analyst must decrypt a browser session that negotiates TLS 1.3 with an ECDHE key exchange and will capture it again while reproducing the activity. The web team offers the server's RSA private key, and the workstation team can start the browser with the SSLKEYLOGFILE environment variable set. Which approach will decrypt the traffic?

1. Load the server's RSA private key under Preferences, RSA Keys
2. Use Decode As to map TCP port 443 to the HTTP dissector
3. Point the TLS key log preference at the browser's key log file
4. Use Follow, TLS Stream, which decrypts using the server certificate

Question 62

You work as a Network Administrator for McRobert Inc. Your company has a TCP/IP-based network. You want to get the protocol statistics and the active TCP/IP network connections of your computer.

Which of the following will you use?

1. IPSTAT
2. SNMP
3. ARP
4. NBTSTAT
5. NETSTAT

Question 63

Every network device contains a unique built in Media Access Control (MAC) address, which is used to identify the authentic device to limit the network access.

Which of the following addresses is a valid MAC address?

1. A3-07-B9-E3-BC-F9
2. 132.298.1.23
3. F936.28A1.5BCD.DEFA
4. 1011-0011-1010-1110-1100-0001

Question 64

You work as a Network Administrator for TechPerfect Inc. The company has a corporate intranet setup. A router is configured on your network to connect outside hosts to the internetworking. For security, you want to prevent outside hosts from pinging to the hosts on the internetwork.

Which of the following steps will you take to accomplish the task?

1. Block the ICMP protocol through ACL.
2. Block the IPv6 protocol through ACL.
3. Block the UDP protocol through ACL.
4. Block the TCP protocol through ACL.

Question 65

Suricata alerts on overlapping IPv4 fragments with conflicting data sent to a Linux server at 10.20.30.40. The host-os-policy section of suricata.yaml is shown.

host-os-policy:
  windows: [0.0.0.0/0]
  bsd: []
  linux: []

What should the analyst change so Suricata reassembles that traffic the way the server will?

1. Raise the defrag memcap so every overlapping fragment can be buffered
2. Lower the defrag timeout so conflicting fragments are flushed sooner
3. Add a rule with fragbits:M; so the overlapping fragments are flagged
4. Add 10.20.30.40 to the linux list so its overlap handling is mimicked

Question 66

At which layers of the OSI and TCP/IP models does IP addressing function?

1. OSI Layer 5 and TCP/IP Transport Layer
2. OSI Layer 2 and TCP/IP Network Layer
3. OSI Layer 4 and TCP/IP Application Layer
4. OSI Layer 3 and TCP/IP Internet Layer

Question 67

An analyst runs Wireshark on a Linux server with TCP checksum validation turned on. Every packet the server sends shows an invalid TCP checksum, while every packet it receives validates. What is the most likely cause?

1. A faulty cable is corrupting outbound frames on the wire
2. A kernel rootkit is altering the headers of sent packets
3. The upstream switch rewrites checksums on outbound traffic
4. Checksum offloading leaves the field for the NIC to fill

Question 68

John, a malicious hacker, forces a router to stop forwarding packets by flooding it with many open connections simultaneously so that all hosts behind it are effectively disabled.

Which of the following attacks is John performing?

1. Rainbow attack
2. DoS attack
3. ARP spoofing
4. Replay attack

Question 69

Which of the following firewalls keeps track of the state of network connections traveling across the network?

1. Stateful firewall
2. Application-level firewall
3. Packet filtering firewall
4. Circuit-level firewall

Question 70

An analyst wants packets that use any TCP port from 6660 to 6669 and writes the filter below. The result also shows ordinary web traffic, such as a client on port 54012 talking to a server on port 80.

tcp.port >= 6660 && tcp.port <= 6669

Which filter returns only packets with a port in that range?

1. tcp.port in {6660..6669}
2. tcp.port == 6660..6669
3. tcp.srcport >= 6660 || tcp.dstport <= 6669
4. tcp.port >= 6660 || tcp.port <= 6669

Question 71

An analyst right-clicks a packet, chooses Follow, TCP Stream, reads the conversation and closes the dialog with the Close button. The packet list now shows only that one conversation. Why, and how could the earlier view have been kept?

1. Follow marked the stream's packets; Unmark All Displayed restores the view
2. Follow exported the stream to a new capture file, which is now open
3. Follow applied a stream display filter; Back would have restored it
4. Follow set the other packets as ignored until they are unignored

Question 72

Which of the following proxy servers is placed anonymously between the client and remote server and handles all of the traffic from the client?

1. Caching proxy server
2. Web proxy server
3. Forced proxy server
4. Open proxy server

Question 73

What does a firewall check to prevent certain ports and applications from getting the packets into an Enterprise?

1. The application layer port numbers and the transport layer headers
2. The presentation layer headers and the session layer port numbers
3. The network layer headers and the session layer port numbers
4. The transport layer port numbers and the application layer headers

Question 74

Which of the following tools is described below?

It is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of its tools include arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. It is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc.

1. Dsniff
2. Libnids
3. Cain
4. LIDS

Question 75

A sensor shows one internal workstation sending SYNs to 1,000 ports on a server. For every open port it completes the three-way handshake and then closes the connection at once without sending data; closed ports answer with RST/ACK. The user has no administrator rights and no raw-socket tools. Which nmap scan type matches?

1. Half-open SYN scan (-sS)
2. TCP connect scan (-sT)
3. TCP ACK scan (-sA)
4. TCP null scan (-sN)

Question 76

An analyst crafts a TCP segment in Scapy and leaves the chksum field at its default. What is written into the checksum field when the packet is serialized for sending?

1. The constant 0x0000, meaning no checksum
2. A random 16-bit value chosen per packet
3. A correct checksum computed over the packet
4. The constant 0xFFFF as a placeholder

Question 77

A sensor logs an IPv4 packet whose header begins with the bytes below.

43 00 00 28

What is the most accurate assessment of the header?

1. Valid IPv4 header followed by 3 bytes of options
2. Valid IPv4 header that is 43 bytes long in total
3. Valid IPv4 header in a short 12-byte form
4. Malformed IPv4 header, since IHL 3 is below 5

Question 78

In a capture, a TCP ACK appears as a 60-byte Ethernet II frame (FCS not captured). The IPv4 Total Length is 0x0028 and the IHL is 5. The last 6 bytes of the frame are all 0x00. What are those 6 bytes?

1. Hidden data appended after the end of the TCP segment
2. TCP options carried after the fixed 20-byte TCP header
3. Ethernet padding added to reach the minimum data size
4. IP options placed between the IPv4 and TCP headers

Question 79

An analyst has a text file, bad.txt, with one threat-intelligence IP address per line and wants every flow in which either endpoint is on that list. Which approach works?

1. rwsetbuild bad.txt bad.set, then rwfilter --anyset=bad.set
2. rwset --any-file=bad.txt, then rwfilter --sipset=bad.txt
3. rwfilter --any-cidr=bad.txt, reading the list as a file
4. rwsetbuild bad.txt bad.set, then rwfilter --sipset=bad.set

Question 80

Crafted scan traffic often uses a bare 20-byte TCP header, while real clients add options. An analyst wants a filter that matches TCP segments whose header is longer than 20 bytes, meaning options are present. Which filter does this?

1. tcp[12] & 0x0f > 5
2. tcp[12] & 0xf0 > 0x50
3. tcp[12] > 5
4. tcp[13] & 0xf0 > 0x50

Question 81

While reviewing traffic captured from a network management segment, an analyst needs to identify polling requests sent from a management station to a device's SNMP agent. Which port do these requests target?

1. TCP port 110
2. TCP port 25
3. TCP port 80
4. UDP port 161

Question 82

Which of the following Web attacks is performed by manipulating codes of programming languages such as SQL, Perl, Java present in the Web pages?

1. Command injection attack
2. Code injection attack
3. Cross-Site Request Forgery
4. Cross-Site Scripting attack

Question 83

An analyst reviews the following Snort 3 rule.

alert tcp $HOME_NET any -> any 22 (msg:"Client SSH version is not 2.0"; flow:established,to_server; content:"SSH-",depth 4; content:!"SSH-2.0",depth 7; sid:1000005; rev:1;)

Which client data makes this rule alert?

1. An identification line that begins with SSH-2.0-OpenSSH_9.6
2. An identification line that begins with SSH-1.5-PuTTY_0.58
3. Any client packet to port 22 that does not begin with SSH-
4. A server identification line SSH-1.5 sent from port 22

Question 84

You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008-based network. You have created a test domain for testing IPv6 addressing.

Which of the following types of addresses are supported by IPv6?

Each correct answer represents a complete solution.

Choose all that apply.

1. Unicast
2. Multicast
3. Broadcast
4. Anycast

Question 85

A local Suricata rule with gid 1 and sid 9000101 alerts on connections to a file-sharing service. Every alert involving the backup server 10.20.0.15 is a known false positive, whether that server is the source or the destination, and the rule must keep alerting for all other hosts. Which threshold.config entry achieves this?

1. suppress gen_id 1, sig_id 9000101
2. suppress gen_id 1, sig_id 9000101, track by_src, ip 10.20.0.15
3. threshold gen_id 1, sig_id 9000101, type limit, track by_src, count 1, seconds 60
4. suppress gen_id 1, sig_id 9000101, track by_either, ip 10.20.0.15

Question 86

An attacker makes an attempt against a Web server. The result is that the attack takes the form of URLs. These URLs search for a certain string that identifies an attack against the Web server.

Which IDS/IPS detection method do the URLs use to detect and prevent an attack?

1. Anamoly-based detection
2. Policy-based detection
3. Honey pot detection
4. Signature-based detection

Question 87

An authorized nmap FIN scan (-sF) of a Windows file server reports every port closed, although the server is known to offer SMB on TCP 445. The capture shows RST/ACK returned for every FIN probe, including the one to port 445. What explains the result?

1. The stack sends RST to these probes whether the port is open or not
2. A host firewall rewrote each FIN probe into a SYN before delivery
3. The probe to 445 matched a live session, which the server then reset
4. Only open ports answer FIN with RST, so every scanned port is open

Question 88

Which of the following technologies is used to detect unauthorized attempts to access and manipulate computer systems locally or through the Internet or an intranet?

1. Demilitarized zone (DMZ)
2. Intrusion detection system (IDS)
3. Firewall
4. Packet filtering

Question 89

An analyst extracts the ARP payload (the bytes after the 14-byte Ethernet header) from a frame captured on a user VLAN:

0000  00 01 08 00 06 04 00 02 3c 52 82 1a 7f 44 c0 a8
0010  0a 01 a4 bb 6d 10 22 9e c0 a8 0a 25

What does this ARP message assert?

1. 192.168.10.37 is at a4:bb:6d:10:22:9e, in a request sent to 192.168.10.1
2. 192.168.10.1 is at 3c:52:82:1a:7f:44, in a reply sent to 192.168.10.37
3. Who has 192.168.10.1? Tell 192.168.10.37, in a broadcast request
4. 192.168.10.1 is at a4:bb:6d:10:22:9e, in a reply sent to 192.168.10.37

Question 90

A single 9-hour SSH session appears in SiLK as several flow records. rwcut shows the attributes field as T on the first record, CT on the middle records and C on the last. What explains this?

1. The session was hijacked, and C marks the attacker's traffic
2. Packets of equal size triggered splits, marked by the T value
3. The sensor dropped packets and opened a new record each time
4. The flow generator's active timeout split a long-lived session

Question 91

Which of the following types of firewall functions by creating two different communications, one between the client and the firewall, and the other between the firewall and the end server?

1. Stateful firewall
2. Proxy-based firewall
3. Packet filter firewall
4. Endian firewall

Question 92

You are responsible for security at a company that specializes in e-commerce. You realize that given the high volume of Web traffic, there is a significant chance of someone being able to breach your perimeter. You want to make sure that should this occur, you can redirect the attacker away from sensitive data.

How would you best accomplish this?

1. Implement a passive IDS
2. Implement a honey pot.
3. Implement a stateful packet inspection firewall.
4. Implement a network based IDS.

Question 93

An analyst pulls a day of data with the command below and finds no flows leaving the network, although outbound DNS is known to occur.

rwfilter --start-date=2026/09/14 --proto=17 --pass=udp.rw

What is the most likely reason?

1. The class's default types often cover only incoming traffic
2. rwfilter skips outbound records unless --sensors is given
3. UDP records are stored only under a class named for UDP
4. A start date with no end date selects only the first hour

Question 94

Which of the following is used as a default port by the TELNET utility?

1. 21
2. 80
3. 23
4. 20

Question 95

Which of the following protocols is used by voice over IP (VoIP) applications?

1. UDP
2. TCP
3. ICMP
4. IPv6

Question 96

An IDS logs the first 14 bytes of a TCP header from an inbound packet.

c3 51 01 bb 5e 2a 91 07 00 00 00 00 50 29

What kind of probe is it?

1. A SYN scan probe sent with the urgent flag also added
2. A Maimon scan probe that has FIN and ACK set
3. A null scan probe with only reserved bits set
4. An Xmas scan probe that has FIN, PSH and URG set

Question 97

Which of the following are not functions of the SNORT application?

Each correct answer represents a complete solution.

Choose two.

1. Packet logging
2. Virus detection
3. Hard disk drive scanning
4. Packet sniffing
5. Intrusion detection

Question 98

An analyst wants tcpdump to catch nmap Null scan probes, which carry a TCP header with no flag bits set at all. Which filter matches them?

1. tcp[tcpflags] & tcp-fin == 0
2. tcp[tcpflags] == 0
3. tcp[tcpflags] != 0
4. tcp[12] == 0

Question 99

Which of the following are the main components of an intrusion detection system? Each correct answer represents a complete solution. Choose two.

1. Sensor
2. Gateway
3. Firewall
4. Modem
5. Console

Question 100

You work as a network administrator for BlueWell Inc. You have to convert your 48-bit host address (MAC address) to an IPv6 54-bit address.

Using the IEEE-EUI-64 conversion process, how do you convert the 48-bit host address (MAC address) to an IPv6 54-bit address?

1. Add EF. FE between the third and fourth bytes.
2. Add FE. EE between the third and fourth bytes.
3. Add FF. EE between the third and fourth bytes.
4. Add FF. FE between the third and fourth bytes

Question 101

An analyst hunting for a TCP covert channel wants segments that carry a nonzero urgent pointer even though the URG flag is clear. Which filter does this?

1. tcp[16:2] != 0 and tcp[13] & 0x20 == 0
2. tcp[18:2] != 0 and tcp[13] & 0x10 == 0
3. tcp[18:2] != 0 and tcp[13] & 0x20 == 0
4. tcp[18:2] != 0 and tcp[12] & 0x20 == 0

Question 102

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He wants to send malicious data packets in such a manner that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the We-are-secure server and execute malicious data.

Which of the following tools can he use to accomplish the task?

1. Hunt
2. Alchemy Remote Executor
3. Mendax
4. Ettercap

Question 103

A Snort 3 rule that looks for the string PASS in client data sent to TCP port 21 keeps firing on single crafted packets sent without any handshake. Which flow option limits the rule to client data inside an established TCP connection?

1. flow:established,to_server;
2. flow:stateless,to_server;
3. flow:established,to_client;
4. flow:not_established,from_client;

Question 104

An analyst runs rwfilter with --pass=stdout directly in a terminal to look at the matching flows, and rwfilter refuses to write the output there. What should the analyst do?

1. Add --print-statistics so the records print as text
2. Pipe the stream through rwsort to make it readable
3. Pipe the pass stream into rwcut to print the records
4. Use --all-destination=stdout so text output is allowed

Question 105

Which of the following techniques allows probing firewall rule-sets and finding entry points into the targeted system or network?

1. Network enumerating
2. Packet collision
3. Distributed Checksum Clearinghouse
4. Packet crafting

Question 106

An analyst sees these packets from an external host to an internal server behind a firewall (tcpdump -n -S). Port 82 never answers.

203.0.113.50.45001 > 10.10.0.8.80: Flags [.], ack 2875431109, win 1024, length 0
10.10.0.8.80 > 203.0.113.50.45001: Flags [R], seq 2875431109, win 0, length 0
203.0.113.50.45001 > 10.10.0.8.81: Flags [.], ack 2875431109, win 1024, length 0
10.10.0.8.81 > 203.0.113.50.45001: Flags [R], seq 2875431109, win 0, length 0
203.0.113.50.45001 > 10.10.0.8.82: Flags [.], ack 2875431109, win 1024, length 0

What is the external host learning?

1. That ports 80 and 81 are open and port 82 is closed
2. That port 80 is open and 81 is closed, from the RST windows
3. That 80 and 81 are unfiltered and 82 is filtered
4. That ports 80 and 81 are closed and port 82 is open

Question 107

An analyst runs the following rwfilter command against the SiLK repository.

rwfilter --start-date=2026/09/14 --type=in --proto=6 --dport=22 --pass=ssh.rw --fail=other.rw

Which records are written to other.rw?

1. Every selected record that is not TCP to destination port 22
2. Only TCP records whose destination port is something other than 22
3. Only the non-TCP records, since port tests apply only to TCP
4. Only records that failed both the protocol and the port tests

Question 108

An analyst extracts the following 20-byte IPv4 header, in hex, from a capture.

45 00 05 dc 1c 46 20 00 40 11 21 bb 0a 01 01 05 0a 02 02 09

What does the header show about fragmentation?

1. An unfragmented UDP datagram sent with the Don't Fragment bit set
2. The first fragment of a fragmented UDP datagram, with 1480 data bytes
3. A middle fragment of a UDP datagram whose data starts at byte 8192
4. The last fragment of a fragmented UDP datagram, with 1480 data bytes

Question 109

Which of the following UDP ports are used by the Simple Network Management Protocol (SNMP) for agent queries and trap notifications? Each correct answer represents a complete solution. Choose two.

1. UDP port 69
2. UDP port 161
3. UDP port 137
4. UDP port 162

Question 110

The fragment summary below covers one second of traffic from one source to one destination (offsets shown in bytes).

10.4.4.4 > 10.9.9.9: id 4021, offset 0, flags [+], proto UDP (17), length 1500
10.4.4.4 > 10.9.9.9: id 4021, offset 0, flags [+], proto ICMP (1), length 1500
10.4.4.4 > 10.9.9.9: id 4021, offset 1480, flags [none], proto UDP (17), length 120
10.4.4.4 > 10.9.9.9: id 4021, offset 1480, flags [none], proto ICMP (1), length 120

How many original datagrams will the destination reassemble?

1. One, because all four fragments share ID 4021 and the same address pair
2. Four, because duplicate offsets turn each fragment into its own datagram
3. None, because the duplicate offsets force the host to discard all four
4. Two, because the protocol field separates the UDP and ICMP fragment sets

Question 111

Which of the following commands will you use with the tcpdump command to display the contents of the packets?

1. tcpdump -q
2. tcpdump -v
3. tcpdump -n
4. tcpdump -A

Question 112

A Snort 3 rule flags unusually large DNS queries with the option below. Each candidate packet is IPv4 with a 20-byte header (IHL 5) carrying UDP to port 53 and no IP options.

dsize:>512;

Which IP total length value belongs to a packet that matches?

1. 532
2. 540
3. 536
4. 548

Question 113

Which of the following is a signature-based intrusion detection system (IDS) ?

1. Snort
2. StealthWatch
3. RealSecure
4. Tripwire

Question 114

You work as a technician for Tech Perfect Inc. You are troubleshooting an Internet name resolution issue. You ping your ISP's DNS server address and find that the server is down. You want to continuously ping the DNS address until you have stopped the command.

Which of the following commands will you use?

1. ping -a
2. ping -l
3. ping -t
4. ping -n

Question 115

An analyst filters a web server capture with the filter below to find receivers that stopped accepting data, but the results are dominated by RST segments, which also carry a window of 0.

tcp.window_size == 0

Which filter lists only true zero-window advertisements?

1. tcp.window_size == 0 && tcp.flags.syn == 0
2. tcp.analysis.window_full
3. tcp.analysis.zero_window_probe
4. tcp.analysis.zero_window

Question 116

Which of the following statements about the File Transfer Protocol (FTP) is true?

1. It holds files transmitted through POP3 mail.
2. It manages network devices.
3. It connects file servers on the World Wide Web.
4. It transfers files between computers.
5. It allows password free file transfers.

Question 117

A client sends the SYN below (tcpdump -n -S). No process listens on port 8443 and no firewall is in the path.

10.3.3.7.55210 > 192.0.2.60.8443: Flags [S], seq 4026531900, win 64240, options [mss 1460], length 0

Which reply should the analyst expect from 192.0.2.60?

1. Flags [R], seq 4026531901, win 0, length 0
2. Flags [R.], seq 4026531900, ack 1, win 0, length 0
3. Flags [S.], seq 0, ack 4026531901, win 0, length 0
4. Flags [R.], seq 0, ack 4026531901, win 0, length 0

Question 118

An analyst lists the fragments of one IPv4 datagram. All share the same ID, addresses and protocol, and each has a 20-byte header.

Frag 1: offset field 0, MF=1, total length 1500
Frag 2: offset field 185, MF=1, total length 1020
Frag 3: offset field 310, MF=1, total length 517
Frag 4: offset field 372, MF=0, total length 77

Which fragment breaks the fragmentation rules?

1. Fragment 1, because a first fragment may carry no more than 1472 data bytes
2. Fragment 2, because offset 185 does not follow on from a 1480-byte first fragment
3. Fragment 3, because it has MF set but carries 497 data bytes, not a multiple of 8
4. Fragment 4, because a last fragment must also carry a multiple of 8 data bytes

Question 119

Which of the following algorithms is used as a default algorithm for ESP extension header in IPv6?

1. Propagating Cipher Block Chaining (PCBC) Mode
2. Cipher Block Chaining (CBC) Mode
3. Electronic Codebook (ECB) Mode
4. Cipher Feedback (CFB) Mode

Question 120

An analyst wants TCP flow records in which the SYN flag was seen but the ACK flag never was, a common sign of scanning or unanswered connection attempts. Which rwfilter switch does this?

1. --flags-all=SA/SA
2. --flags-all=S/S,A/A
3. --flags-all=S/SA
4. --flags-all=SA/S

Question 121

A perimeter sensor on the Internet-facing link records inbound TCP SYN packets with source address 127.0.0.1 and destination 198.51.100.20. How should the analyst classify them?

1. Spoofed: loopback addresses must never appear outside a host
2. Normal: replies sent by the server's own loopback services
3. Normal: the ISP numbers its NAT pool from 127.0.0.0/8
4. Spoofed only when the TTL in the header is greater than 64

Question 122

A Snort 3 rule meant to catch percent-encoded directory traversal never fires, although captured requests contain /cgi-bin/%2e%2e%2f%2e%2e%2fetc/passwd. The rule uses these options.

http_uri; content:"%2e%2e%2f",nocase;

Which change lets the rule match the encoded sequence?

1. Use the http_raw_uri sticky buffer instead of http_uri
2. Use the http_header sticky buffer instead of http_uri
3. Keep http_uri and change the content to ../ instead
4. Keep http_uri and add fast_pattern to the content

Question 123

A sensor records the following exchange (tcpdump -n -S). The same pattern continues across hundreds of ports.

198.51.100.23.61022 > 10.9.1.10.443: Flags [S], seq 1520147893, win 1024, options [mss 1460], length 0
10.9.1.10.443 > 198.51.100.23.61022: Flags [S.], seq 2210078812, ack 1520147894, win 64240, options [mss 1460], length 0
198.51.100.23.61022 > 10.9.1.10.443: Flags [R], seq 1520147894, win 0, length 0
198.51.100.23.61022 > 10.9.1.10.444: Flags [S], seq 1520147893, win 1024, options [mss 1460], length 0
10.9.1.10.444 > 198.51.100.23.61022: Flags [R.], seq 0, ack 1520147894, win 0, length 0

Which conclusion fits the traffic?

1. A connect scan that found 443 open and 444 closed
2. A half-open SYN scan that found 443 open and 444 closed
3. A half-open SYN scan that found 443 closed and 444 filtered
4. A SYN flood against 443 from a single spoofed address

Question 124

Distributed Checksum Clearinghouse (DCC) is a hash sharing method of spam email detection.

Which of the following protocols does the DCC use?

1. TCP
2. TELNET
3. ICMP
4. UDP

Question 125

Which of the following techniques is used to identify attacks originating from a botnet?

1. IFilter
2. BPF-based filter
3. Passive OS fingerprinting
4. Recipient filtering

Question 126

An analyst wants a tcpdump filter that captures every IPv4 fragment except the first one, meaning every fragment that carries no transport header. Which filter does this?

1. ip[6:2] & 0x1fff != 0
2. ip[6] & 0x20 != 0
3. ip[6:2] & 0x3fff != 0
4. ip[6:2] & 0x4000 != 0

Question 127

John works as a professional Ethical Hacker for SecureEnet Inc. The company has a Windowsbased network. All client computers run on Windows XP. A project has been assigned to John to investigate about the open ports responsible for various malicious attacks on the network.

John wants to use the DOS command-line utility to find out the open ports.

Which of the following DOS commands will John use to accomplish the task?

1. tracert and pathping
2. nslookup
3. nbtstat
4. netstat