Application Protocols GCIA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A network analyst is investigating a suspected DNS tunneling incident. In a packet capture, they see many DNS queries for subdomains of a domain controlled by an attacker. Each query is a standard A record request, and the subdomain labels contain base64-encoded data. The responses are A records with IP addresses that appear to be from a public DNS server. Which DNS header field or section would most likely contain the exfiltrated data if the attacker is using DNS tunneling?

   • AThe Additional section's OPT pseudo-record
   • BThe Answer section's A record IP address
   • CThe query name in the Question section
   • DThe Authority section's NS records
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   When analyzing HTTPS traffic in a packet capture, why is it generally not possible to view the full contents of HTTP requests and responses?

   • ABecause the packets are compressed and cannot be decompressed
   • BBecause the server does not send HTTP responses over TLS
   • CBecause HTTP headers are removed before transmission
   • DBecause the HTTP messages are encrypted within TLS
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst is inspecting SNMP traffic and sees a packet with a community string of 'public' and a PDU type of 0xA0 (GetRequest). The source IP is 10.0.0.50 and the destination is 10.0.0.1 on port 161. What is the most likely purpose of this packet?

   • AAn attacker is attempting to modify the device's configuration using the default community string
   • BA network management station is querying a device for information
   • CA device is setting a configuration value on the management station
   • DA device is sending a trap to the management station
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In IMAP, which command is used to select a mailbox for reading messages?

   • ARETR
   • BFETCH
   • CSELECT
   • DLIST
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An email security analyst is reviewing SMTP traffic and sees a session where the client sends 'EHLO client.example.com' and the server responds with '250-AUTH LOGIN PLAIN'. The client then sends 'AUTH LOGIN' and the server responds with '334 VXNlcm5hbWU6'. The client sends a base64-encoded username and password. What is the most likely security concern with this SMTP authentication method?

   • AThe client is using a compromised account to send spam
   • BThe credentials are sent in plaintext and can be easily intercepted
   • CThe server is using an outdated authentication method that is no longer supported
   • DThe server is not verifying the client's identity
   Reveal Solution Discussion Select an answer first