An analyst is reviewing a capture and sees a large number of TCP SYN packets sent to a single host from many different source IP addresses, all with the same destination port 80. The destination host is responding with SYN-ACKs, but the sources are not completing the handshake. What is the most likely explanation?

A network scan is being performed to identify open ports.

The sources are experiencing packet loss and are retransmitting SYN packets.

A distributed SYN flood attack is consuming server resources.

The server is misconfigured and is sending RSTs instead of SYN-ACKs.

Which of the following is a normal traffic pattern that might be observed in a packet capture?

A client sending a DNS query and receiving a response

A host sending ICMP echo requests to a broadcast address

A single host sending SYN packets to every port on a subnet

A host sending a large number of TCP RST packets in a short time

A network analyst is reviewing a TCP capture and notices that the sender's window size is consistently 0 for several seconds. What does this indicate?

The receiver is experiencing congestion and is asking the sender to pause.

The connection is being closed gracefully.

The sender is retransmitting packets due to packet loss.

The sender is experiencing congestion and is reducing its transmission rate.

GIAC Certified Intrusion Analyst

Domain 4Objective 1

Packet Engineering GCIA Practice Questions (Page 1)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 1–5

1foundation · easy
Which protocol encapsulates an IP packet within an Ethernet frame?
Select an answer first
2expert · hard
An analyst is reviewing a capture and sees a large number of TCP SYN packets sent to a single host from many different source IP addresses, all with the same destination port 80. The destination host is responding with SYN-ACKs, but the sources are not completing the handshake. What is the most likely explanation?
Select an answer first
3foundation · easy
In a TCP three-way handshake, what is the correct sequence of flags exchanged?
Select an answer first
4foundation · easy
Which of the following is a normal traffic pattern that might be observed in a packet capture?
Select an answer first
5application · medium
A network analyst is reviewing a TCP capture and notices that the sender's window size is consistently 0 for several seconds. What does this indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Packet Engineering GCIA Practice Questions (Page 1)

Questions 1–5

Which protocol encapsulates an IP packet within an Ethernet frame?

In a TCP three-way handshake, what is the correct sequence of flags exchanged?

Which of the following is a normal traffic pattern that might be observed in a packet capture?

A network analyst is reviewing a TCP capture and notices that the sender's window size is consistently 0 for several seconds. What does this indicate?

Keep studying — Packet Analysis and Engineering