Application Protocols GCIA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is examining a pcap and sees an HTTP request with the following headers: 'GET /login.php HTTP/1.1', 'Host: www.example.com', 'Content-Length: 0', and 'Cookie: sessionid=abc123'. The response is 'HTTP/1.1 302 Found' with a 'Location: /dashboard'. Which of the following best describes the interaction?

   • AThe server is responding with a 302 because the requested resource has been permanently moved.
   • BThe client is using a non-standard HTTP method, and the server is rejecting the request.
   • CThe client is sending a POST request with a payload, and the server is responding with an error.
   • DThe client is requesting a login page, and the server is redirecting the client to a dashboard, likely because the session cookie is valid.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is reviewing a DNS capture and sees a query for 'legit-service.com' with the QR bit set to 0. The response has the QR bit set to 1, the AA bit set to 1, and the answer section contains an A record for 203.0.113.10. The response also contains an additional section with an OPT record indicating EDNS0 support. The analyst notices that the response's transaction ID matches the query. Which of the following is the most significant finding?

   • AThe response is normal because the QR bit is set to 1, indicating a response.
   • BThe presence of an OPT record in the additional section is a sign of a DNS tunneling attempt.
   • CThe transaction ID matching is a sign of a DNS cache poisoning attempt.
   • DThe AA bit being set indicates the response is from an authoritative server, which is normal for a recursive resolver's response.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In SNMPv1 and SNMPv2c, what is the purpose of the community string?

   • AIt identifies the MIB being queried
   • BIt encrypts the SNMP messages
   • CIt specifies the SNMP version
   • DIt acts as a password to control access to the managed device
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is reviewing SNMP traffic and sees a packet with a community string of 'private' and a PDU type of 0xA3 (SetRequest). The source IP is 10.0.0.50 and the destination is 10.0.0.1 on port 161. The OID in the packet is 1.3.6.1.2.1.1.5.0 (sysName) with a value of 'NewRouter'. What is the most likely security concern?

   • AThe device is sending a trap to the management station to report a configuration change
   • BAn attacker is using the default 'private' community string to modify the device's configuration
   • CThe management station is querying the device's system name for inventory purposes
   • DThe device is using SNMPv3 with authentication and privacy
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is investigating a potential data exfiltration. The pcap shows a TLS session to an external IP on port 443. The analyst can see the ClientHello with an SNI of 'update.example.com' and a certificate that is self-signed. The analyst also sees that the session is using TLS 1.2. Which of the following is the most significant indicator of malicious activity?

   • AThe session is encrypted, so it is impossible to determine if it is malicious.
   • BThe use of TLS 1.2 is outdated and indicates the server is vulnerable.
   • CThe certificate being self-signed is normal for internal services, so there is no concern.
   • DThe SNI 'update.example.com' is suspicious because it mimics a legitimate update domain, and the self-signed certificate is a strong indicator of a non-legitimate service.
   Reveal Solution Discussion Select an answer first