2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

GIAC Certified Intrusion Analyst GCIA Exam Practice Questions, practice question pack
GIAC · Certified Intrusion Analyst GCIA

GIAC Certified Intrusion Analyst GCIA Exam Practice Questions

99% pass rateUpdated 1 Nov 2026507 questions2 PDFs, instant download
4.816 reviews
(16 customer reviews)

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
I have passed my GCIA exams. Strongly recommended!
MooreCertified Intrusion Analyst GCIA
Category:
TRY BEFORE YOU BUY

Three of the 507 questions in this pack

Question 1

An analyst runs tcpdump -n -S on a client's uplink and captures the start of a connection. The third segment is shown with its acknowledgment number removed.

10.1.1.20.51514 > 203.0.113.80.443: Flags [S], seq 2944051730, win 64240, options [mss 1460,sackOK,TS val 1803321 ecr 0,nop,wscale 7], length 0
203.0.113.80.443 > 10.1.1.20.51514: Flags [S.], seq 1180366102, ack 2944051731, win 65160, options [mss 1460,sackOK,TS val 99120 ecr 1803321,nop,wscale 7], length 0
10.1.1.20.51514 > 203.0.113.80.443: Flags [.], ack ??????????, win 502, length 0

Which acknowledgment number must the client's third segment carry to complete the three-way handshake?

  1. 2944051731
  2. 1180366103
  3. 1180366102
  4. 2944051732
Show answer and explanation

Correct answer: B. 1180366103

The SYN/ACK carries the server's initial sequence number, 1180366102. A SYN occupies one sequence number even though it carries no data, so the next sequence number the client expects from the server is 1180366102 + 1 = 1180366103, and that is the value its ACK must carry. The server applied the same rule in its own ACK: 2944051730 + 1 = 2944051731. A third segment that acknowledged the bare ISN, or any other value, would not complete a normal handshake.

Why the other options are wrong

  • A. 2944051731 is the client's own next sequence number, which the server acknowledged, not a value the client acknowledges.
  • C. 1180366102 is the server's ISN itself, and acknowledging it ignores the sequence number that the SYN consumes.
  • D. 2944051732 adds two to the client's own ISN and has nothing to do with the server's sequence space.

Question 2

Sasha wants to add an entry to your DNS database for your mail server.

Which of the following types of resource records will she use to accomplish this?

  1. ANAME
  2. SOA
  3. MX
  4. CNAME
Show answer and explanation

Correct answer: C. MX

MX (Mail Exchange) records are used in DNS to specify the mail servers responsible for receiving email for a domain. They are essential for directing email traffic to the correct mail server. ANAME is not a standard DNS record type, SOA defines zone parameters, and CNAME creates aliases for hostnames.

Why the other options are wrong

  • A. ANAME is not a standard DNS resource record type.
  • B. SOA records define Start of Authority parameters for a DNS zone, not mail server entries.
  • D. CNAME records create canonical name aliases but are not used specifically for mail server entries.

Question 3

In Wireshark 4.x an analyst applies the display filter below, intending to hide all traffic to or from 10.0.0.5.

ip.addr !== 10.0.0.5

Which packets remain displayed?

  1. Only packets in which neither address is 10.0.0.5
  2. Any packet with an address other than 10.0.0.5
  3. No packets, because !== is not valid for address fields
  4. Only packets whose source is 10.0.0.5, as !== tests the source
Show answer and explanation

Correct answer: B. Any packet with an address other than 10.0.0.5

ip.addr stands for both the source and the destination address, so comparisons on it test two values. The !== operator (any_ne) is true when any occurrence differs from the value, so a packet from 10.0.0.5 to 10.0.0.9 still matches because its destination differs. Only a packet with 10.0.0.5 in both fields would be hidden. To hide the host's traffic, use ip.addr != 10.0.0.5, which since Wireshark 3.6 means all not equal, or the explicit !(ip.addr == 10.0.0.5).

Why the other options are wrong

  • A. That result needs all-not-equal semantics, which is ip.addr != 10.0.0.5, not !==.
  • C. !== is a valid C-like operator, the alias of any_ne.
  • D. ip.addr represents both the source and destination addresses, and !== tests whether any of them differs.

See all 127 free questions Get the full pack, US$39

REVIEWS

16 reviews for GIAC Certified Intrusion Analyst GCIA Exam Practice Questions

  1. Moore –

    I have passed my GCIA exams. Strongly recommended!

  2. Giles –

    I would recommend the GCIA exam file for anyone preparing to take the exam. The questions are all valid and enough to pass. Good luck!

  3. Lennon –

    Thank you team Cert Stash for the amazing exam dumps pdf files. Prepared me so well and I was able to get 96% marks in the GIAC Information Security exam.

  4. Hazel –

    I purchased GCIA exam dump, so thankful to these guys for creating such dumps which helped me pass the GCIA exam with 90% on my first attempt. Thanks a lot!

  5. Georgia –

    This GCIA study guide helped me get ready for my exam and it is worth the price, I would recommend this to anyone who wants to GCIA pass exam.

  6. Ophelia –

    Passed to day in France with a nice score 90%. New questions is little. Thanks a lot. The GCIA exam is latest.

  7. Hubery –

    I have passed the GCIA exam test on the first try, so happy. Thanks very much!

  8. Geoffrey –

    I pass the GCIA today, thanks for a lot! the questions are valid, you can trust them.

  9. Khalid Farooq –

    No regrets buying

    Fantastic for GCIA preparation

  10. Grover –

    Thank you! I have got your GCIA update yesterday.

  11. Myron –

    Luckily, I got a satisfied score studied with your GCIA dump. Very happy!

  12. Lance –

    Thanks Cert Stash GCIA practice questions.

  13. Jared Allen –

    Good prep

    Good for GCIA preparation

  14. Constance –

    Thanks for your GIAC Certified Intrusion Analyst dumps.

  15. Mateo Kapoor –

    Good stuff

    Got my GCIA

  16. Xu Torres –

    Thanks, passed first time

    Passed GCIA. Thanks.

Only logged in customers who have purchased this product may leave a review.

How much of the GIAC Certified Intrusion Analyst GCIA bank is free?

507 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 12725% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 253the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 507100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the GIAC Certified Intrusion Analyst GCIA pack

  • 507 questions mapped to the GCIA exam objectives
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

The GCIA costs US$999 per attempt. This pack is US$39, paid once.

What makes the GCIA hard

The GCIA goes deeper on network traffic than most security professionals have ever had to go. It is 106 questions in four hours, open book, with a 67% pass mark.

This is not about recognising attack patterns. It is about understanding protocol behaviour at the packet level: TCP/IP internals, IDS signature development, application-layer protocol analysis, network forensics, and fragmentation-based attacks. Most candidates who struggle have not gone deep enough on the technical side.

This pack has 507 practice questions for the GCIA, covering that much ground because the exam does, so it is a way to find the gaps before GIAC does.

About the exam

The GCIA validates hands-on skill in monitoring and analysing network traffic to detect and respond to intrusions. It covers the full spectrum from low-level packet analysis to IDS tuning and network forensics, making it one of the most technically demanding network defence certifications available. It is aligned to SANS SEC503.

Questions before you buy

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products