Fragmentation GCIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which packet analysis tool feature is specifically designed to reassemble IP fragments for inspection?

   • AWireshark's 'IP Reassembly' preference
   • Btcpdump's '-f' option
   • CWireshark's 'Follow TCP Stream' feature
   • DNmap's 'fragment' scan option
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An IDS analyst is reviewing alerts about a possible evasion attempt. The capture shows a TCP packet fragmented into two fragments: the first fragment is 8 bytes and contains the TCP header, and the second fragment contains the rest of the TCP header and payload. What is the primary purpose of this fragmentation pattern?

   • ATo speed up reassembly by using small fragments
   • BTo bypass stateful inspection by hiding the TCP flags in the second fragment
   • CTo reduce network congestion by sending smaller packets
   • DTo ensure the packet fits within the MTU of the path
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An IDS analyst is reviewing a rule that detects overlapping fragments. The rule flags any packet where the fragment offset is less than the sum of the previous fragment's offset and payload length. The analyst notices that the rule is generating many alerts for legitimate traffic. What is the most likely reason?

   • AThe rule is incorrectly using the MF flag to determine overlap.
   • BThe rule is using the wrong identification field.
   • CThe rule does not account for fragments that are exactly adjacent, which is normal.
   • DThe rule is triggering on unfragmented packets.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network analyst is investigating a possible denial-of-service attack. The analyst sees a flood of incomplete fragmented packets: each packet is split into fragments, but the final fragment (MF=0) is never sent. The destination host is consuming resources waiting for reassembly. What is the most effective mitigation?

   • ADisable fragmentation on the destination host.
   • BConfigure the destination host's reassembly timeout to a shorter value.
   • CBlock all fragmented traffic at the firewall.
   • DIncrease the reassembly buffer size on the destination host.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What happens if a receiving host does not receive all fragments of an IP datagram within the reassembly timeout?

   • AThe host waits indefinitely for the missing fragments
   • BThe host reassembles the fragments it has and delivers the partial payload to the upper layer
   • CThe host forwards the fragments to the next hop for reassembly
   • DThe host sends an ICMP Time Exceeded message to the source and discards the fragments
   Reveal Solution Discussion Select an answer first