Data on the Network GBFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a TCP packet, which field is used to identify the application-layer protocol that should receive the data?

   • AWindow size
   • BSequence number
   • CChecksum
   • DDestination port number
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are analyzing a pcap from a compromised server. You notice a large volume of outbound DNS queries to a domain that is not on the corporate allowlist. The queries are for subdomains that appear to be hex-encoded. The server is also sending large amounts of data to an external IP on port 443. What is the most likely combined activity?

   • ANormal DNS resolution for a legitimate service that uses hex-encoded subdomains.
   • BA DDoS attack using DNS amplification.
   • CA misconfigured DNS server returning incorrect records.
   • DDNS tunneling for data exfiltration, with the HTTPS traffic being a decoy or additional exfiltration channel.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A forensic examiner has captured network traffic from a corporate network during an investigation. The capture includes traffic from a personal device belonging to an employee, which was connected to the corporate Wi-Fi. The company's monitoring policy covers corporate devices but not personal devices. The examiner needs to preserve the evidence for potential litigation. What is the best course of action?

   • AIgnore the personal device traffic and only use the corporate device traffic.
   • BAnonymize the personal device traffic and then use it in the investigation.
   • CDelete the personal device traffic from the capture to avoid legal issues.
   • DPreserve the capture as-is, but document the presence of personal device traffic and consult legal counsel before using it.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic examiner is preparing to capture network traffic from a corporate switch port that carries a mix of user and server traffic. The organization has a legal requirement to preserve evidence for potential litigation. The examiner needs a capture that preserves the full packet contents and can be used to reconstruct application-layer sessions later. Which approach best meets the requirement?

   • AUse an inline network tap and capture only TCP SYN packets to minimize storage.
   • BEnable NetFlow export on the switch and collect flow records for the duration of the incident.
   • CConfigure a SPAN port and capture with tcpdump using the -s 0 option, writing to a dedicated forensic storage volume.
   • DInstall a packet capture agent on the server and use netstat to log active connections.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a network traffic analysis, an examiner notices that a server is sending a large number of TCP RST packets to a client immediately after receiving a SYN packet. The client is not sending any additional packets. What is the most likely cause?

   • AThe client is using a spoofed IP address.
   • BThe server is rejecting the connection because the port is closed or filtered.
   • CThe server is experiencing a denial-of-service attack.
   • DThe server is performing a SYN flood attack.
   Reveal Solution Discussion Select an answer first