Your organization is legally required to inspect all outbound HTTPS traffic for data exfiltration. However, some employees use personal devices that do not trust the corporate CA, and breaking TLS inspection would violate their privacy. You need to balance security and privacy. What is the best approach?

Disable TLS inspection entirely and rely on endpoint detection.

Block all HTTPS traffic from personal devices to prevent exfiltration.

Implement TLS inspection only for corporate-managed devices and allow personal devices to bypass inspection, but log SNI and certificate metadata.

Inspect all traffic regardless of device ownership to ensure compliance.

A security analyst is monitoring a network that uses a mix of Windows and Linux hosts. The analyst notices that a Windows host is making SMB connections to a Linux server that is not configured as a Samba server. The connections occur at random intervals and transfer small files. The analyst suspects the Linux server may be compromised and used as a staging point. Which action would provide the most definitive evidence to confirm or refute this suspicion?

Use a network scanner to identify open ports on the Linux server.

Block SMB traffic to the Linux server at the firewall to prevent further connections.

Correlate the SMB connections with the Linux server's authentication logs and file system audit logs to see if the connections are legitimate.

Check the Windows host's event logs for SMB connection records.

When analyzing TLS-encrypted HTTP traffic, which technique allows an analyst to inspect the plaintext content?

Looking at the DNS queries for the domain

Examining the TCP sequence numbers

Reading the HTTP headers from the TLS handshake

Using the server's private key to decrypt the session

An analyst is examining a DNS packet in a protocol analyzer. Which fields would be visible after proper decoding?

Source and destination ports only

HTTP status code and reason phrase

SMTP commands like HELO and MAIL

During an incident, you see a server (IP 10.0.0.5) making outbound connections to multiple external IPs on port 445 (SMB). The server is a known Linux web server. Which conclusion is most justified?

The server may be compromised and used for SMB-based scanning or propagation.

The server is legitimately backing up files to a network share.

The server is performing DNS resolution for external domains.

The server is serving web content to external clients.

GIAC Certified Detection Analyst

Domain 3Objective 2

Application Protocol Analytics GCDA Practice Questions (Page 2)

Part of the Network and Asset Analytics domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 6–10 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 6–10

6expert · medium
Your organization is legally required to inspect all outbound HTTPS traffic for data exfiltration. However, some employees use personal devices that do not trust the corporate CA, and breaking TLS inspection would violate their privacy. You need to balance security and privacy. What is the best approach?
Select an answer first
7expert · hard
A security analyst is monitoring a network that uses a mix of Windows and Linux hosts. The analyst notices that a Windows host is making SMB connections to a Linux server that is not configured as a Samba server. The connections occur at random intervals and transfer small files. The analyst suspects the Linux server may be compromised and used as a staging point. Which action would provide the most definitive evidence to confirm or refute this suspicion?
Select an answer first
8foundation · easy
When analyzing TLS-encrypted HTTP traffic, which technique allows an analyst to inspect the plaintext content?
Select an answer first
9foundation · easy
An analyst is examining a DNS packet in a protocol analyzer. Which fields would be visible after proper decoding?
Select an answer first
10application · medium
During an incident, you see a server (IP 10.0.0.5) making outbound connections to multiple external IPs on port 445 (SMB). The server is a known Linux web server. Which conclusion is most justified?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.