Why is it important to preserve the original packet capture (PCAP) files when responding to an incident detected by an IDS?

To use them as evidence in legal proceedings or further analysis

To free up disk space on the IDS sensor

To automatically update the IDS signatures

To improve the performance of the IDS

Which traffic pattern is most indicative of a network reconnaissance scan?

A series of TCP SYN packets sent to multiple ports on a single host in rapid succession

An HTTP request to a web server for a valid page

A continuous stream of ICMP echo requests to a broadcast address

A single large file transfer from an internal host to an external server

A network analyst notices that an IDS is generating alerts for a known exploit signature, but the exploit is not succeeding. The analyst suspects an attacker is using fragmentation to evade detection. Which observation would confirm this suspicion?

The IDS is seeing the exploit payload in a single packet, but the source IP is spoofed

The IDS alerts only when the full packet reassembles, and the fragmented packets individually do not match the signature

The IDS is not reassembling fragments, so the exploit payload is split across multiple packets and the signature never matches

The IDS is seeing overlapping fragments that, when reassembled, create a packet that matches the exploit signature

A security team is comparing IDS detection methods for a network that experiences high false positives with signature-based detection. They also need to detect polymorphic malware that changes its signature. Which detection method is most effective for polymorphic malware?

Anomaly-based detection that monitors behavior and traffic patterns

Signature-based detection with frequent signature updates

Stateful protocol analysis to detect protocol violations

GIAC Certified Enterprise Defender

Domain 1Objective 3

Intrusion Detection and Packet Analysis GCED Practice Questions (Page 4)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

Questions 16–20

16foundation · easy
Why is it important to preserve the original packet capture (PCAP) files when responding to an incident detected by an IDS?
Select an answer first
17foundation · easy
In a TCP packet header, which field is used to identify the application or service on the destination host?
Select an answer first
18foundation · easy
Which traffic pattern is most indicative of a network reconnaissance scan?
Select an answer first
19application · medium
A network analyst notices that an IDS is generating alerts for a known exploit signature, but the exploit is not succeeding. The analyst suspects an attacker is using fragmentation to evade detection. Which observation would confirm this suspicion?
Select an answer first
20expert · hard
A security team is comparing IDS detection methods for a network that experiences high false positives with signature-based detection. They also need to detect polymorphic malware that changes its signature. Which detection method is most effective for polymorphic malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.