Fragmentation GCIA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In an IPv4 fragment, what does the Fragment Offset field represent?

   • AThe total length of the original IP packet before fragmentation
   • BThe sequence number of the fragment in the order it was transmitted
   • CThe position of this fragment's data in the original IP payload, measured in 8-byte units
   • DThe number of bytes of the original payload that precede this fragment's data
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network administrator is configuring a firewall to block large ICMP packets. The administrator wants to allow ICMP echo requests but prevent oversized packets that could be used for denial-of-service. The firewall currently drops all ICMP packets with the DF flag set. What is the effect of this configuration?

   • AIt blocks all ICMP packets, both fragmented and unfragmented.
   • BIt allows all ICMP packets, because DF is only relevant to IPv6.
   • CIt blocks legitimate large ICMP packets that cannot be fragmented, but allows fragmented ICMP packets.
   • DIt has no effect because DF is only set on fragments.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A host receives three fragments with the same identification. Fragment A has offset 0 and MF=1. Fragment B has offset 185 and MF=1. Fragment C has offset 370 and MF=0. The payload lengths are 1480, 1480, and 1020 bytes respectively. What is the total length of the reassembled IP packet (including the IP header)?

   • A4000 bytes
   • B3980 bytes
   • C2960 bytes
   • D4020 bytes
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is using Wireshark to examine a fragmented packet. The reassembled packet shows a TCP segment with a payload that, when reassembled, contains a known attack signature. However, the IDS did not alert because it only inspected individual fragments. What is the most effective way to ensure the IDS detects this attack in the future?

   • AUse a different IDS that does not support reassembly.
   • BConfigure the IDS to alert on any fragmented TCP traffic.
   • CIncrease the IDS's reassembly timeout to ensure all fragments are captured.
   • DEnable fragment reassembly in the IDS so it can inspect the full payload.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is reviewing alerts from an IDS. The IDS flagged a series of fragments where the first fragment has an offset of 0 and contains a valid TCP header, but a later fragment with offset 0 also contains a TCP header. What is the most likely explanation?

   • AThe fragments are part of a legitimate path MTU discovery process.
   • BAn overlapping fragment attack is being used to hide malicious content.
   • CThe IDS is misinterpreting the fragment offset field.
   • DThe fragments are simply retransmissions of the same packet.
   Reveal Solution Discussion Select an answer first