An analyst is investigating a potential data exfiltration incident. The analyst has identified a series of HTTP POST requests from an internal server to an external IP. Each POST contains a small payload that appears to be base64-encoded. The analyst wants to correlate this activity with a specific asset and determine if it is malicious. Which approach would be most effective?

Check the server's DNS cache to see if it resolved the external IP to a domain.

Extract the source IP and MAC address from the flow, and decode the base64 payloads to see if they contain sensitive data.

Review the server's web server logs for the POST requests.

Block the external IP at the firewall to stop the communication.

You need to detect malware that uses HTTPS to communicate with a C2 server. Your organization has a TLS inspection proxy that can decrypt outbound traffic. What is the most effective detection approach?

Rely solely on SNI and certificate metadata to identify C2 domains.

Block all HTTPS traffic to external IPs that are not on an allowlist.

Inspect the decrypted HTTP payloads for known C2 patterns and beaconing intervals.

Disable TLS inspection to avoid breaking applications and use flow data only.

You see a series of HTTP requests to a web server with the same URI but with varying query parameters that include base64-encoded strings. The requests are coming from a single internal IP at a rate of one per second. What is the most likely explanation?

An automated tool is using the web server as a channel for data exfiltration or command and control.

The requests are normal API calls from a legitimate client.

A user is manually testing the web application.

The web server is under a DDoS attack.

An analyst is examining a packet capture and finds a TCP stream on port 25. The payload contains the string 'EHLO' followed by a server response that includes '250-AUTH LOGIN PLAIN'. The analyst wants to extract the authentication method used by the client. What should the analyst look for in the subsequent packets?

A base64-encoded string following the AUTH command

A series of numeric response codes from the server

A plaintext username and password in the MAIL FROM command

A TLS handshake immediately after the EHLO command

GIAC Certified Detection Analyst

Domain 3Objective 2

Application Protocol Analytics GCDA Practice Questions (Page 5)

Part of the Network and Asset Analytics domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 6–10 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 21–25

21application · medium
An analyst is investigating a potential data exfiltration incident. The analyst has identified a series of HTTP POST requests from an internal server to an external IP. Each POST contains a small payload that appears to be base64-encoded. The analyst wants to correlate this activity with a specific asset and determine if it is malicious. Which approach would be most effective?
Select an answer first
22application · medium
You need to detect malware that uses HTTPS to communicate with a C2 server. Your organization has a TLS inspection proxy that can decrypt outbound traffic. What is the most effective detection approach?
Select an answer first
23foundation · easy
An analyst sees an HTTP request with a URI containing '..%2f..%2fetc%2fpasswd'. Which type of application protocol anomaly does this represent?
Select an answer first
24application · medium
You see a series of HTTP requests to a web server with the same URI but with varying query parameters that include base64-encoded strings. The requests are coming from a single internal IP at a rate of one per second. What is the most likely explanation?
Select an answer first
25application · medium
An analyst is examining a packet capture and finds a TCP stream on port 25. The payload contains the string 'EHLO' followed by a server response that includes '250-AUTH LOGIN PLAIN'. The analyst wants to extract the authentication method used by the client. What should the analyst look for in the subsequent packets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Application Protocol Analytics GCDA Practice Questions (Page 5)

Questions 21–25

You need to detect malware that uses HTTPS to communicate with a C2 server. Your organization has a TLS inspection proxy that can decrypt outbound traffic. What is the most effective detection approach?

An analyst sees an HTTP request with a URI containing '..%2f..%2fetc%2fpasswd'. Which type of application protocol anomaly does this represent?

You see a series of HTTP requests to a web server with the same URI but with varying query parameters that include base64-encoded strings. The requests are coming from a single internal IP at a rate of one per second. What is the most likely explanation?

Keep studying — Network and Asset Analytics