Application Protocols GCIA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A DHCP server administrator is troubleshooting why some clients are not receiving IP addresses. In a packet capture, they see DHCPDISCOVER messages from clients, but no DHCPOFFER messages from the server. The DHCP server is on a different subnet than the clients, and a DHCP relay agent is configured. What is the most likely cause of the missing DHCPOFFER messages?

   • AThe clients are not sending DHCPREQUEST messages
   • BThe DHCP server is out of IP addresses in the scope
   • CThe DHCP relay agent is not configured to forward DHCPDISCOVER messages to the server
   • DThe clients are using DHCPv6, but the server only supports DHCPv4
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   While analyzing HTTP traffic, you see a server response with the status code "404 Not Found". What does this status code indicate?

   • AThe client must authenticate before accessing the resource
   • BThe requested resource could not be found on the server
   • CThe server encountered an internal error
   • DThe request was successfully processed and the resource is returned
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   While inspecting an SMTP transaction in a pcap, you see the following sequence: 220, EHLO, 250, MAIL FROM, 250, RCPT TO, 250, DATA, 354, (message content), 250, QUIT, 221. Which part of this transaction is most likely to contain a malicious payload or phishing content?

   • AThe MAIL FROM and RCPT TO commands because they contain the envelope addresses that are used to spoof the sender.
   • BThe QUIT command because it can be used to terminate the session and hide the transaction from logging.
   • CThe DATA section because it contains the email headers, body, and attachments that can include malicious content.
   • DThe EHLO command because it often contains the sender's domain and can be spoofed.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a DNS response packet, what does the QR bit in the header flags indicate?

   • AWhether the response is truncated
   • BWhether the message is a query or a response
   • CWhether the server is authoritative
   • DWhether recursion is desired
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is reviewing a pcap and sees a TCP session to port 25. The first packet from the client contains 'EHLO mail.example.com'. The server responds with '250-mail.example.com' and then '250 AUTH LOGIN'. The client then sends 'AUTH LOGIN' and a base64-encoded string. Which of the following is the most accurate identification of this traffic?

   • AIt is IMAP traffic, and the AUTH LOGIN command is used to synchronize mail folders.
   • BIt is POP3 traffic, and the AUTH LOGIN command is used to retrieve email.
   • CIt is SMTP traffic, and the AUTH LOGIN command indicates the client is authenticating to send email, which may be a sign of a compromised account if the credentials are stolen.
   • DIt is HTTP traffic, and the AUTH LOGIN command is a standard HTTP authentication method.
   Reveal Solution Discussion Select an answer first