A security analyst is investigating a possible fragmentation attack. The analyst sees a series of fragments with the same identification value, but the fragment offsets are not in ascending order. What should the analyst do?

Ignore the traffic because out-of-order fragments are always benign.

Check if the DF flag is set on any of the fragments.

Verify that the receiving host reassembles them correctly despite the out-of-order arrival.

Flag the traffic as malicious because fragments must arrive in order.

Which IPv4 header field is used to identify that a packet is a fragment and to indicate where it belongs in the original datagram?

The Flags field and the Fragment Offset field together

A security analyst is investigating a possible data exfiltration attempt. The capture shows a series of ICMP echo requests that are fragmented into very small pieces, each containing only a few bytes of payload. The fragments have consistent identification values and are all part of complete datagrams. What is the most likely purpose of this traffic?

To evade IDS by hiding data in tiny fragments

To perform a denial-of-service attack on the IDS

To reduce network latency by using smaller packets

To avoid MTU issues on the path

What does a receiving host use to group fragments that belong to the same original IP datagram?

The source IP address and the Protocol field

The Identification field in the IP header

A network analyst captures an IPv4 packet with the DF flag set and the Fragment Offset field set to 0. The packet is 4000 bytes total. The analyst needs to determine whether this packet is a fragment. What is the correct interpretation?

It is a fragment because the total length exceeds the standard MTU of 1500 bytes.

It is the first fragment of a larger packet because the offset is 0.

It is the last fragment because the offset is 0 and the DF flag is set.

It is not a fragment because the DF flag is set, which prohibits fragmentation.

GIAC Certified Intrusion Analyst

Domain 4Objective 2

Fragmentation GCIA Practice Questions (Page 3)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 11–15

11application · medium
A security analyst is investigating a possible fragmentation attack. The analyst sees a series of fragments with the same identification value, but the fragment offsets are not in ascending order. What should the analyst do?
Select an answer first
12foundation · easy
Which IPv4 header field is used to identify that a packet is a fragment and to indicate where it belongs in the original datagram?
Select an answer first
13expert · hard
A security analyst is investigating a possible data exfiltration attempt. The capture shows a series of ICMP echo requests that are fragmented into very small pieces, each containing only a few bytes of payload. The fragments have consistent identification values and are all part of complete datagrams. What is the most likely purpose of this traffic?
Select an answer first
14foundation · easy
What does a receiving host use to group fragments that belong to the same original IP datagram?
Select an answer first
15application · medium
A network analyst captures an IPv4 packet with the DF flag set and the Fragment Offset field set to 0. The packet is 4000 bytes total. The analyst needs to determine whether this packet is a fragment. What is the correct interpretation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.