Data on the Network GBFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An examiner is analyzing a packet capture and sees a series of TCP packets with the SYN flag set and the ACK flag set in the same packet. What does this indicate?

   • AThe second step of a TCP three-way handshake.
   • BA TCP keepalive packet.
   • CA TCP port scan using the FIN flag.
   • DA TCP reset attack.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   While analyzing a packet capture, an examiner notices a series of TCP connections that complete a three-way handshake and then immediately send a RST packet. The connections are to the same external IP on port 443. What does this pattern most likely indicate?

   • AA legitimate HTTPS client that is failing to negotiate TLS.
   • BA firewall dropping packets due to an access control list.
   • CA network scanner performing TCP connect scans against the external host.
   • DA misconfigured load balancer sending traffic to an unhealthy backend.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Before capturing network traffic for forensic analysis, what is the most important legal consideration?

   • AEnsuring the capture is performed during business hours
   • BStoring the capture on a write-once medium
   • CObtaining proper authorization
   • DUsing the most expensive capture tool
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is reviewing a packet capture and notices that a server is sending a large number of SYN-ACK packets to a client that never sends a final ACK. The client's IP address is not in the internal network range. What is the most likely explanation?

   • AThe server is experiencing a TCP handshake timeout due to network congestion.
   • BThe server is performing a port scan against the client.
   • CThe server is the target of a SYN flood attack using spoofed source IP addresses.
   • DThe client is using a misconfigured firewall that drops the final ACK.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are tasked with capturing network traffic on a 10 Gbps link that carries critical production data. The capture must be complete and lossless, but the budget is limited. You have the option of using a software-based sniffer on a high-end server or a dedicated hardware tap with a capture appliance. Which factor is most important in deciding the method?

   • AThe portability of the capture device.
   • BThe ability of the capture method to handle 10 Gbps throughput without dropping packets.
   • CThe cost of the capture solution, as budget is limited.
   • DThe ease of setup and configuration.
   Reveal Solution Discussion Select an answer first