4.8 Interpret the Fields in Protocol Headers as Related to Intrusion Analysis 200-201 Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   An analyst is reviewing a DNS response packet. The source port is 53 and the destination port is 5353. The UDP length field is 512 bytes. The DNS header shows the QR flag set to 1 and the TC flag set to 1. What does the TC flag indicate?

   • AThe response was signed with DNSSEC
   • BThe response was a referral to another server
   • CThe response was truncated and the client should retry over TCP
   • DThe response was a recursive query
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is reviewing a packet capture and sees an IPv4 packet with the header fields: IHL=5, total length=1500, identification=0x1A2B, flags=0x2 (Don't Fragment set), fragment offset=0, TTL=64, protocol=6, and a TCP segment inside. The analyst notes the TCP header has a data offset of 5 and the flags field shows SYN and ACK set. The destination IP is a public web server. Which conclusion is most defensible from these fields alone?

   • AThe packet has been fragmented because the total length exceeds the standard 576-byte minimum.
   • BThis is the first fragment of a larger TCP segment that will be reassembled.
   • CThe packet is a TCP reset because the ACK flag is set in response to an out-of-order segment.
   • DThe packet is part of a TCP three-way handshake, specifically the SYN-ACK response from the server.
   Reveal Solution Discussion Select an answer first