A security analyst is reviewing a packet capture and notices that a client is sending HTTP requests to a server, but the server's responses are being redirected to a different IP address. The analyst also sees that the client's ARP cache has been modified. What is the most likely attack?

ARP spoofing leading to a man-in-the-middle attack

A security analyst is investigating a slow network and discovers that a host is sending a large number of TCP RST packets to a server. The analyst suspects a TCP reset attack. What is the primary goal of a TCP reset attack?

Flood the network with SYN packets

Terminate an established TCP connection

A network defender is analyzing a packet capture and sees a series of TCP packets with the FIN flag set, but the packets are being sent to a closed port. The defender also notices that the source IP is spoofed. What is the most likely purpose of this traffic?

A FIN scan to probe for open ports

GIAC Certified Enterprise Defender

Domain 1Objective 1

Defending Network Protocols GCED Practice Questions (Page 1)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1application · medium
A security analyst is reviewing a packet capture and notices that a client is sending HTTP requests to a server, but the server's responses are being redirected to a different IP address. The analyst also sees that the client's ARP cache has been modified. What is the most likely attack?
Select an answer first
2application · medium
While reviewing a packet capture, a security analyst sees a large number of TCP SYN packets sent to a single host from many different source IP addresses. The destination host is responding with SYN-ACK packets, but no ACK packets follow. Which type of attack is most likely occurring?
Select an answer first
3foundation · easy
Which tool is specifically designed to capture and analyze network packets in real time?
Select an answer first
4application · medium
A security analyst is investigating a slow network and discovers that a host is sending a large number of TCP RST packets to a server. The analyst suspects a TCP reset attack. What is the primary goal of a TCP reset attack?
Select an answer first
5application · medium
A network defender is analyzing a packet capture and sees a series of TCP packets with the FIN flag set, but the packets are being sent to a closed port. The defender also notices that the source IP is spoofed. What is the most likely purpose of this traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Defending Network Protocols GCED Practice Questions (Page 1)

Questions 1–5

A security analyst is reviewing a packet capture and notices that a client is sending HTTP requests to a server, but the server's responses are being redirected to a different IP address. The analyst also sees that the client's ARP cache has been modified. What is the most likely attack?

While reviewing a packet capture, a security analyst sees a large number of TCP SYN packets sent to a single host from many different source IP addresses. The destination host is responding with SYN-ACK packets, but no ACK packets follow. Which type of attack is most likely occurring?

Which tool is specifically designed to capture and analyze network packets in real time?

A security analyst is investigating a slow network and discovers that a host is sending a large number of TCP RST packets to a server. The analyst suspects a TCP reset attack. What is the primary goal of a TCP reset attack?

A network defender is analyzing a packet capture and sees a series of TCP packets with the FIN flag set, but the packets are being sent to a closed port. The defender also notices that the source IP is spoofed. What is the most likely purpose of this traffic?

Keep studying — Network Defense and Monitoring