An analyst is investigating a possible IDS evasion. The capture shows two fragments with the same identification. The first fragment has offset 0 and payload length 24. The second fragment has offset 2 (in 8-byte units) and payload length 16. What is the result when the target host reassembles these fragments?

The reassembly fails because the offsets are not multiples of 8.

The second fragment is discarded because it is out of order.

The second fragment overlaps the first fragment's data.

The fragments reassemble cleanly with no overlap.

GIAC Certified Intrusion Analyst

Domain 4Objective 2

Fragmentation GCIA Practice Questions (Page 8)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 36–36

36application · medium
An analyst is investigating a possible IDS evasion. The capture shows two fragments with the same identification. The first fragment has offset 0 and payload length 24. The second fragment has offset 2 (in 8-byte units) and payload length 16. What is the result when the target host reassembles these fragments?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Fragmentation GCIA Practice Questions (Page 8)

Questions 36–36

Keep studying — Packet Analysis and Engineering