You are correlating network activity with assets. A database server (10.0.0.10) is seen making HTTP requests to an external IP on port 80. The requests contain a User-Agent of 'curl/7.68.0' and a URI of '/download'. What does this suggest?

The database server is backing up to an external cloud storage.

The database server is performing routine updates.

The database server is serving web content to external clients.

The database server may be compromised and used to download tools or exfiltrate data.

When a packet capture tool decodes an HTTP request, which fields are typically shown in the decoded output?

TCP sequence and acknowledgment numbers

Source and destination MAC addresses

A network sensor captures a packet with a TCP payload that begins with 'GET /admin?id=1 AND 1=1-- HTTP/1.1'. The destination is an internal web server. Which anomaly does this packet represent?

A DNS tunneling attempt using HTTP.

A SQL injection attempt embedded in an HTTP request.

A normal HTTP request for a dynamic web page.

A malformed HTTP request due to an invalid HTTP version.

You are investigating a suspected web shell on a public-facing IIS server. Which metadata extracted from HTTP traffic would be most useful to confirm the presence of a web shell and identify the attacker's tooling?

The User-Agent string and the URI path of POST requests to .aspx files.

The TCP window size and IP TTL values of the connections.

The server's HTTP response headers, such as Server and X-Powered-By.

The client's MAC address and the server's ARP cache.

GIAC Certified Detection Analyst

Domain 3Objective 2

Application Protocol Analytics GCDA Practice Questions (Page 8)

Part of the Network and Asset Analytics domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 6–10 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 36–40

36application · medium
You are correlating network activity with assets. A database server (10.0.0.10) is seen making HTTP requests to an external IP on port 80. The requests contain a User-Agent of 'curl/7.68.0' and a URI of '/download'. What does this suggest?
Select an answer first
37foundation · easy
When a packet capture tool decodes an HTTP request, which fields are typically shown in the decoded output?
Select an answer first
38foundation · easy
An analyst is inspecting HTTP traffic and wants to extract the specific resource path requested by a client. Which field in the HTTP request should they examine?
Select an answer first
39application · medium
A network sensor captures a packet with a TCP payload that begins with 'GET /admin?id=1 AND 1=1-- HTTP/1.1'. The destination is an internal web server. Which anomaly does this packet represent?
Select an answer first
40application · medium
You are investigating a suspected web shell on a public-facing IIS server. Which metadata extracted from HTTP traffic would be most useful to confirm the presence of a web shell and identify the attacker's tooling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.