An analyst is investigating a host that is communicating with a known command-and-control server over HTTPS. The analyst has access to the network traffic but not to the host's TLS private keys. Which approach would provide the most useful information for detecting the C2 communication without decrypting the traffic?

Perform a man-in-the-middle TLS interception by installing a proxy certificate on the host.

Use a passive TLS fingerprinting tool to identify the client's cipher suite and TLS version.

Analyze the TLS certificate metadata, including the issuer, validity period, and Subject Alternative Names, and correlate with the destination IP and connection timing.

Block all traffic to the known C2 IP address at the firewall.

A security analyst notices that an internal host is sending SMTP traffic to an external mail server at a much higher volume than usual, and the messages have no recipients in the envelope. What is the most likely explanation?

The host is sending spam or malicious email through the mail server.

The host is synchronizing time with an NTP server.

The host is downloading email via POP3.

The host is performing a DNS zone transfer.

You have a list of assets: a web server, a database server, and a developer workstation. You see the workstation making connections to the database server on TCP port 3306 (MySQL) during business hours. Which additional context would best determine if this is malicious?

The workstation's MAC address vendor.

The database server's operating system version.

The exact number of packets exchanged.

Whether the workstation is owned by a developer who is known to administer the database.

A network flow record shows a host communicating with a remote server on TCP port 22. The flow lasts for several hours and transfers a large amount of data. Which application protocol is most likely in use?

SMTP (Simple Mail Transfer Protocol).

HTTP (Hypertext Transfer Protocol).

During a forensic investigation, you need to extract the file hash of a malware sample that was downloaded over HTTP. Which metadata from the network capture would provide the file hash?

The HTTP response header 'Content-MD5'.

The TLS certificate of the server.

The TCP sequence numbers of the packets.

The response body's content, which can be hashed after reassembly.

GIAC Certified Detection Analyst

Domain 3Objective 2

Application Protocol Analytics GCDA Practice Questions (Page 7)

Part of the Network and Asset Analytics domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 6–10 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 31–35

31application · medium
An analyst is investigating a host that is communicating with a known command-and-control server over HTTPS. The analyst has access to the network traffic but not to the host's TLS private keys. Which approach would provide the most useful information for detecting the C2 communication without decrypting the traffic?
Select an answer first
32application · medium
A security analyst notices that an internal host is sending SMTP traffic to an external mail server at a much higher volume than usual, and the messages have no recipients in the envelope. What is the most likely explanation?
Select an answer first
33expert · medium
You have a list of assets: a web server, a database server, and a developer workstation. You see the workstation making connections to the database server on TCP port 3306 (MySQL) during business hours. Which additional context would best determine if this is malicious?
Select an answer first
34application · medium
A network flow record shows a host communicating with a remote server on TCP port 22. The flow lasts for several hours and transfers a large amount of data. Which application protocol is most likely in use?
Select an answer first
35application · medium
During a forensic investigation, you need to extract the file hash of a malware sample that was downloaded over HTTP. Which metadata from the network capture would provide the file hash?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.