Fragmentation GCIA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is inspecting a captured IPv4 packet with a total length of 3000 bytes and a 20-byte IP header. The packet must traverse a link with an MTU of 1500 bytes. The analyst wants to determine the fragment offsets of the resulting fragments. What are the correct fragment offsets?

   • A0, 1480, 2960
   • B0, 187, 374
   • C0, 185, 370
   • D0, 1500, 3000
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An IDS analyst is evaluating a new detection rule. The rule flags any packet with a fragment offset greater than 0 and a payload length less than 100 bytes. The analyst is concerned about false positives. Which scenario would most likely generate a false positive?

   • AA normal unfragmented packet with a small payload.
   • BA legitimate fragmented packet where the last fragment is small.
   • CA fragment with a large offset and a large payload.
   • DAn attacker sending tiny fragments to evade detection.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An IDS analyst is tuning a network sensor to detect fragmentation-based evasion. The sensor currently reassembles fragments using a policy that favors the first fragment's data on overlap. An attacker sends a series of overlapping fragments where the first fragment contains benign data and the second contains malicious payload. What is the most effective way to detect this attack?

   • ABlock all fragmented traffic from the source IP.
   • BDisable reassembly and inspect each fragment individually.
   • CConfigure the sensor to use a policy that favors the last fragment's data on overlap.
   • DIncrease the reassembly timeout to allow more fragments to arrive.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An IDS is configured to reassemble fragments using a policy that favors the first fragment's data on overlap. An attacker sends a series of fragments where the first fragment contains benign data and a later overlapping fragment contains malicious content. The IDS does not alert, but the destination host reassembles the packet and the attack succeeds. What is the most effective way to prevent this evasion?

   • ADisable fragment reassembly in the IDS and inspect each fragment individually.
   • BIncrease the reassembly timeout in the IDS to allow more time for fragments to arrive.
   • CConfigure the IDS to use a reassembly policy that matches the destination host's operating system.
   • DBlock all fragmented traffic to the destination host.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of IP fragmentation in IPv4 networking?

   • ATo allow a large IP packet to be transmitted across a network link with a smaller maximum transmission unit (MTU)
   • BTo combine multiple small packets into a single larger packet to reduce overhead
   • CTo encrypt the payload of an IP packet to protect it during transmission
   • DTo reduce the size of the IP header to improve transmission efficiency
   Reveal Solution Discussion Select an answer first