Fragmentation GCIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network engineer is analyzing a packet capture of a fragmented IPv4 packet. The first fragment has an offset of 0 and MF=1, and the second fragment has an offset of 185 and MF=0. What is the total size of the original IP packet (including the IP header)?

   • A1500 bytes
   • B3000 bytes
   • C2960 bytes
   • D2980 bytes
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is examining a pcap file and sees a fragment with an offset of 0 and MF=1, followed by a fragment with an offset of 185 and MF=1, but no fragment with MF=0. What should the analyst conclude?

   • AThe identification field is incorrect, causing the fragments to be treated as separate packets.
   • BThe fragments are malformed and will be dropped by the receiving host.
   • CThe fragments are part of a valid packet and will reassemble correctly.
   • DThe capture is incomplete; the final fragment is missing.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a possible attack. The capture shows a series of fragments with the same identification, but the fragment offsets are not in sequential order. The first fragment has offset 0, the second has offset 370, and the third has offset 185. All fragments have MF=1 except the last one. What should the analyst conclude?

   • AThe fragments are part of an attack and should be blocked.
   • BThe fragments are out of order and will be reassembled correctly by the receiving host.
   • CThe fragments will be discarded because they are out of order.
   • DThe fragments are from different datagrams because the offsets are not sequential.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a common goal of fragmentation-based evasion techniques used against intrusion detection systems (IDS)?

   • ATo encrypt the payload so the IDS cannot read it
   • BTo cause the IDS to reassemble fragments in a different order than the destination host
   • CTo bypass firewall rules that block large packets
   • DTo increase the speed of packet transmission to overwhelm the IDS
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network analyst captures three IPv4 fragments with the same identification value. Fragment A has offset 0 and MF=1. Fragment B has offset 185 and MF=1. Fragment C has offset 370 and MF=0. Each fragment carries 1480 bytes of payload. The analyst wants to confirm the fragments will reassemble into a single valid packet. What should the analyst verify?

   • AThat the DF flag is set on all three fragments to ensure they arrive in order.
   • BThat fragment C's offset plus its payload length equals the total length of the original unfragmented packet.
   • CThat the MF flag is set on fragment C to indicate more fragments follow.
   • DThat the identification field is different on each fragment to avoid reassembly confusion.
   Reveal Solution Discussion Select an answer first