A network administrator is troubleshooting a DHCP issue. In a packet capture, they see a DHCPDISCOVER from a client, followed by a DHCPOFFER from the server, then a DHCPREQUEST from the client, and finally a DHCPACK. The client still has no IP address. Which of the following is the most likely cause?

The DHCPREQUEST was broadcast, but the server did not receive it because of a firewall rule.

The DHCPOFFER contained an invalid subnet mask option, so the client rejected it.

The DHCPACK contained an option that the client considered invalid, such as a conflicting IP address or missing default gateway.

The DHCPDISCOVER was sent from the wrong interface, so the server responded on a different subnet.

An analyst is looking at a packet capture of email client traffic. They see a TCP session on port 143 that includes the commands 'a001 LOGIN user@example.com password', 'a002 SELECT INBOX', and 'a003 FETCH 1 BODY[]'. Which protocol is being used, and what is the client doing?

POP3; the client is downloading all messages from the server

HTTPS; the client is accessing webmail

SMTP; the client is sending an email message

IMAP; the client is retrieving the full content of a specific email message

GIAC Certified Intrusion Analyst

Domain 4Objective 3

Application Protocols GCIA Practice Questions (Page 3)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

11concepts

Questions 11–15

11foundation · easy
In a DNS packet, which section contains the question being asked by the client?
Select an answer first
12application · medium
A network administrator is troubleshooting a DHCP issue. In a packet capture, they see a DHCPDISCOVER from a client, followed by a DHCPOFFER from the server, then a DHCPREQUEST from the client, and finally a DHCPACK. The client still has no IP address. Which of the following is the most likely cause?
Select an answer first
13foundation · easy
In an SNMP packet, which PDU type is used by the manager to request the value of a specific variable from an agent?
Select an answer first
14application · medium
An analyst is looking at a packet capture of email client traffic. They see a TCP session on port 143 that includes the commands 'a001 LOGIN user@example.com password', 'a002 SELECT INBOX', and 'a003 FETCH 1 BODY[]'. Which protocol is being used, and what is the client doing?
Select an answer first
15foundation · easy
Which protocol is designed to download email messages from a server to a local client, typically deleting them from the server after download?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Application Protocols GCIA Practice Questions (Page 3)

Questions 11–15

In a DNS packet, which section contains the question being asked by the client?

In an SNMP packet, which PDU type is used by the manager to request the value of a specific variable from an agent?

An analyst is looking at a packet capture of email client traffic. They see a TCP session on port 143 that includes the commands 'a001 LOGIN user@example.com password', 'a002 SELECT INBOX', and 'a003 FETCH 1 BODY[]'. Which protocol is being used, and what is the client doing?

Which protocol is designed to download email messages from a server to a local client, typically deleting them from the server after download?

Keep studying — Packet Analysis and Engineering