Application Protocols GCIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An analyst sees two remote administration sessions in a pcap. Session 1 is on port 23 and contains readable text like 'root@server:~#'. Session 2 is on port 22 and contains only encrypted data after a handshake. Which session should be treated as a higher security risk, and why?

   • ABoth sessions are equally risky because both allow remote command execution.
   • BNeither session is risky because the analyst can see the traffic.
   • CSession 1, because Telnet transmits credentials and commands in plaintext, allowing anyone on the path to capture them.
   • DSession 2, because SSH is more complex and can hide malicious activity in the encrypted stream.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary security advantage of SSH over Telnet?

   • ASSH is faster than Telnet
   • BSSH encrypts all session data
   • CSSH compresses the data to save bandwidth
   • DSSH uses a different port number
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An analyst is reviewing a pcap and sees a TCP session to port 8080. The first packet from the client contains the line 'GET /admin HTTP/1.1' followed by 'Host: internal.corp.local'. The server responds with 'HTTP/1.1 401 Unauthorized'. Which of the following is the most accurate identification of this traffic?

   • AIt is FTP traffic because port 8080 is commonly used for FTP control connections.
   • BIt is HTTPS traffic that has been decrypted by a proxy, and the 401 response indicates a certificate error.
   • CIt is HTTP traffic on a non-standard port, and the 401 response indicates the client is not authenticated.
   • DIt is SMTP traffic because the server responded with a 401 status code.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An analyst is looking at a pcap from a mail server and sees a session that includes the commands USER, PASS, STAT, RETR, and DELE. Which protocol is this, and what is the analyst able to conclude about the client's behavior?

   • APOP3; the client is downloading messages and then deleting them from the server.
   • BIMAP; the client is using a non-standard extension to delete messages after retrieval.
   • CIMAP; the client is synchronizing folders and will remain connected to receive push notifications.
   • DSMTP; the client is sending email messages through the server.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In a packet capture of an HTTP exchange, the client sends a request line that begins with "GET /index.html HTTP/1.1". What does the "GET" portion of the request line indicate?

   • AThe status code the server will return
   • BThe HTTP method the client is invoking
   • CThe version of HTTP being used
   • DThe hostname of the target server
   Reveal Solution Discussion Select an answer first