Application Protocols GCIA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is reviewing a packet capture and sees traffic on TCP port 8080. The payload contains the ASCII string 'GET /index.html HTTP/1.1' followed by 'Host: internal.example.com'. The analyst also notices that the source and destination IPs are both internal addresses. Which application protocol is most likely in use, and what is a key consideration for identification?

   • AFTP; the 'GET' command is used to retrieve files
   • BHTTP; the port is non-standard but the payload clearly shows an HTTP request
   • CTelnet; the 'GET' command is a common Telnet command
   • DHTTPS; the port 8080 is commonly used for SSL proxies
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is examining HTTP traffic and sees a request with the method 'PROPFIND' to a web server. The server responds with '501 Not Implemented'. The analyst also notices that the User-Agent header is 'Microsoft-WebDAV-MiniRedir/10.0.16299'. What is the most likely explanation for this traffic?

   • AA user is attempting to access a WebDAV share on a server that does not support WebDAV
   • BThe server is misconfigured and returning 501 for all requests
   • CAn attacker is using a WebDAV exploit to gain unauthorized access
   • DA client is using a non-standard HTTP method to bypass security controls
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   While reviewing a packet capture from a web server, you notice a series of requests to /admin/login.php that return HTTP/1.1 302 Found responses. Each request uses the POST method and includes a body containing 'username=admin&password=letmein'. The responses include a Location header pointing to /admin/dashboard.php. What is the most likely explanation for this traffic pattern?

   • AA user is repeatedly clicking the login button due to a slow network connection.
   • BA client is successfully authenticating to the admin panel with valid credentials.
   • CThe web server is misconfigured and redirecting all POST requests to the dashboard.
   • DAn attacker is performing a brute-force login attempt against the admin panel.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A packet capture shows TCP traffic to port 25 on a remote server. Which application protocol is most likely being used?

   • ASMTP
   • BDNS
   • CHTTP
   • DFTP
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A network security analyst is comparing two remote administration sessions in a pcap. Session A is on port 23 and contains the text 'Password: ' followed by what appears to be a password in plaintext. Session B is on port 22 and contains a TLS-like handshake followed by encrypted data. The analyst needs to determine which session is more likely to be an attacker's remote access. Which of the following is the most accurate conclusion?

   • ASession A is more likely to be malicious because the plaintext password can be captured and reused, and Telnet is often used by attackers for simple access.
   • BBoth sessions are equally likely to be malicious because both allow remote command execution.
   • CSession B is more likely to be malicious because SSH is commonly used by attackers to hide their activities.
   • DNeither session is likely to be malicious because remote administration is a normal activity.
   Reveal Solution Discussion Select an answer first