Concepts of TCP/IP and the Link Layer GCIA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An analyst is investigating a possible network scan. The capture shows a series of IP packets with the same source and destination IPs, but the TTL field varies (e.g., 64, 63, 62, 61) and the destination port is the same. The packets are TCP SYN packets. What is the most likely explanation?

   • AThe packets are fragments of a single larger packet that were reassembled incorrectly.
   • BThe packets are part of a traceroute-like probe to map the network path to the destination.
   • CThe packets are retransmissions from the source due to packet loss.
   • DThe packets are spoofed with random TTL values to evade detection.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst suspects an ARP spoofing attack on the LAN. The analyst runs `arp -a` on a workstation and sees that the default gateway's IP address is mapped to an unknown MAC address. Which of the following actions would best confirm the attack?

   • ASend a ping to the gateway and see if the ARP cache updates to the correct MAC.
   • BReboot the workstation and check the ARP cache again.
   • CCheck the switch's CAM table to see which port the unknown MAC address is associated with.
   • DCompare the unknown MAC address with the vendor OUI and the known MAC of the legitimate gateway.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is examining a packet capture and sees an Ethernet frame with a destination MAC of 01:00:5e:00:00:fb and an EtherType of 0x0800. The IP destination is 224.0.0.251. What is this frame?

   • AAn IPv6 multicast frame for the mDNS group.
   • BAn IPv4 unicast frame sent to a specific host's MAC address.
   • CAn IPv4 broadcast frame sent to all hosts on the local network.
   • DAn IPv4 multicast frame for the mDNS group, sent to all hosts subscribed to that multicast address.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network engineer is troubleshooting a performance issue between two hosts on different subnets. The path includes a VPN tunnel with an MTU of 1400 bytes. The sending host has an MTU of 1500 and is sending large TCP segments. The engineer observes that packets are being fragmented. Which action would most effectively reduce fragmentation while maintaining connectivity?

   • AIncrease the sending host's MTU to 1500 to match the LAN.
   • BSet the TCP MSS option to 1360 on the sending host.
   • CSet the IP Don't Fragment (DF) bit on all outgoing packets.
   • DConfigure the router to fragment all packets before entering the tunnel.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is examining a TCP stream and sees a packet with the ACK flag set and an acknowledgment number of 4500. The next packet in the stream has a sequence number of 4500. What does this indicate?

   • AThe receiver is indicating that the connection is being closed.
   • BThe receiver is acknowledging data up to byte 4499 and expecting the next byte to be sequence number 4500.
   • CThe receiver is sending its own sequence number 4500.
   • DThe receiver has received 4500 bytes of data and is requesting more.
   Reveal Solution Discussion Select an answer first