Application Protocol Analytics GCDA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   You are inspecting a packet capture and see a DNS response with the QR bit set to 1, a response code of 3 (NXDOMAIN), and a question section containing a long string of hex characters followed by '.example.com'. What does this indicate?

   • AA normal DNS response for a valid domain.
   • BA malformed DNS packet with an invalid header.
   • CA DNS amplification attack.
   • DA DNS query for a non-existent subdomain, possibly part of a data exfiltration attempt.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   You are tuning an IDS to detect DNS tunneling. You notice that legitimate dynamic DNS services also generate many unique subdomains. Which additional filter would best reduce false positives while still detecting tunneling?

   • AFlag queries that return NXDOMAIN responses.
   • BFlag all queries to domains with more than five labels.
   • CFlag only queries with a high entropy per label and a low frequency of repeated labels.
   • DFlag queries that use TCP instead of UDP.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A packet capture shows a client sending a query to a server, followed by a response that contains an 'A' record. Which application protocol is being used?

   • ADNS
   • BSMB
   • CSMTP
   • DHTTP
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An analyst is examining TLS traffic and wants to identify the certificate presented by the server. Which part of the TLS handshake contains the certificate?

   • ACertificate message
   • BServerHello
   • CClientHello
   • DFinished message
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator notices that a DNS server is receiving a high volume of queries for a single domain from many internal hosts. The queries are all for the same subdomain with random-looking labels, and the response sizes are larger than typical DNS responses. The administrator suspects DNS tunneling. Which additional observation would most strongly support this suspicion?

   • AThe queries originate from a single host rather than multiple hosts.
   • BThe queries are all using TCP instead of UDP.
   • CThe subdomain labels are base64-encoded and decode to non-DNS data.
   • DThe DNS server is configured to allow recursive queries from the internal network.
   Reveal Solution Discussion Select an answer first