An analyst sees an IPv4 packet with the Don't Fragment (DF) flag set and the More Fragments (MF) flag clear. What does this indicate?

The packet is a fragment and this is the last fragment

The packet is a fragment and more fragments will follow

The packet has been fragmented and reassembled

The packet is not fragmented and must not be fragmented by routers

A network engineer is debugging why a router is dropping IPv4 packets. The packets have a valid header checksum when they arrive, but the router modifies the TTL field and forwards them. The next router drops them due to a checksum error. What is the most likely cause?

The first router did not recompute the header checksum after decrementing the TTL

The packets were too large for the next hop

The packets had incorrect source addresses

The packets were fragmented by the first router

A network engineer is comparing IPv4 and IPv6 headers to decide whether to implement IPv6 in a network that frequently experiences corrupted packets. The engineer notes that IPv6 does not have a header checksum. What is the primary reason for this design choice?

The IPv6 header is encrypted, so a checksum would be redundant.

The IPv6 header is fixed at 40 bytes, so a checksum is unnecessary.

Upper-layer protocols like TCP and UDP already provide checksums, and link-layer technologies often have error detection.

IPv6 uses a larger address space, making checksums less important.

GIAC Certified Intrusion Analyst

Domain 1Objective 2

IP Headers GCIA Practice Questions (Page 1)

Part of the Network Fundamentals domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~33–56 in this domain), expect 7–11 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

11concepts

Questions 1–5

1application · medium
An analyst sees an IPv4 packet with the Don't Fragment (DF) flag set and the More Fragments (MF) flag clear. What does this indicate?
Select an answer first
2foundation · easy
Which IPv4 header field is used to indicate the upper-layer protocol carried in the IP payload?
Select an answer first
3expert · medium
A network engineer is debugging why a router is dropping IPv4 packets. The packets have a valid header checksum when they arrive, but the router modifies the TTL field and forwards them. The next router drops them due to a checksum error. What is the most likely cause?
Select an answer first
4application · medium
A network engineer is comparing IPv4 and IPv6 headers to decide whether to implement IPv6 in a network that frequently experiences corrupted packets. The engineer notes that IPv6 does not have a header checksum. What is the primary reason for this design choice?
Select an answer first
5foundation · easy
In an IPv4 header, which field immediately follows the Total Length field?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

IP Headers GCIA Practice Questions (Page 1)

Questions 1–5

An analyst sees an IPv4 packet with the Don't Fragment (DF) flag set and the More Fragments (MF) flag clear. What does this indicate?

Which IPv4 header field is used to indicate the upper-layer protocol carried in the IP payload?

A network engineer is debugging why a router is dropping IPv4 packets. The packets have a valid header checksum when they arrive, but the router modifies the TTL field and forwards them. The next router drops them due to a checksum error. What is the most likely cause?

A network engineer is comparing IPv4 and IPv6 headers to decide whether to implement IPv6 in a network that frequently experiences corrupted packets. The engineer notes that IPv6 does not have a header checksum. What is the primary reason for this design choice?

In an IPv4 header, which field immediately follows the Total Length field?

Keep studying — Network Fundamentals