Application Protocols GCIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When analyzing network traffic, which characteristic is a key indicator that the traffic is Telnet rather than SSH?

   • AThe handshake includes a key exchange
   • BThe connection uses port 22
   • CThe payload is encrypted
   • DThe payload is transmitted in plaintext
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In an SMTP session, the client sends the command "EHLO example.com". What is the purpose of this command?

   • ATo initiate the email transfer session and request server capabilities
   • BTo send the email message body
   • CTo specify the recipient of the email
   • DTo authenticate the client to the server
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a DHCP packet capture, which message type is sent by the client to discover available DHCP servers?

   • ADHCPOFFER
   • BDHCPDISCOVER
   • CDHCPACK
   • DDHCPREQUEST
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is comparing two remote administration sessions in a packet capture. Session A uses port 22 and the payload is encrypted. Session B uses port 23 and the payload contains plaintext commands like 'ls -la' and 'cat /etc/passwd'. Which session poses a greater security risk, and why?

   • ASession A, because SSH is more complex and prone to misconfiguration
   • BSession B, because the plaintext commands can be intercepted and sensitive information is exposed
   • CBoth sessions are equally risky because they both allow remote command execution
   • DSession A, because encrypted traffic can hide malicious commands
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic analyst is examining a pcap from a compromised email account. The analyst sees a session on port 143 that includes the commands 'a001 LOGIN user@company.com password', 'a002 SELECT INBOX', 'a003 FETCH 1 BODY[]', and 'a004 LOGOUT'. Which of the following is the most significant security concern?

   • AThe SELECT INBOX command is anomalous because an attacker would not need to select a folder before fetching messages.
   • BThe FETCH command is a sign that the attacker is downloading the entire mailbox, which is a data exfiltration indicator.
   • CThe use of port 143 indicates the session is unencrypted, and the LOGIN command exposes the user's credentials in plaintext.
   • DThe LOGOUT command indicates the attacker is trying to hide their tracks by closing the session quickly.
   Reveal Solution Discussion Select an answer first