Packet Engineering GCIA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   In a packet capture, an analyst sees a TCP stream with the following pattern: packet 1 (seq=1000, len=100), packet 2 (seq=1100, len=100), packet 3 (seq=1000, len=100), packet 4 (seq=1200, len=100). What does this pattern indicate?

   • AThe stream is experiencing packet loss and the receiver is sending duplicate ACKs.
   • BPacket 3 is an out-of-order packet, and packet 4 is a duplicate.
   • CPacket 3 is a retransmission of packet 1, and packet 4 continues the stream.
   • DThe sender is reordering packets to evade detection.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which field in the IPv4 header is used to identify fragments that belong to the same original packet?

   • AIdentification
   • BFragment Offset
   • CFlags
   • DTTL
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In an Ethernet frame, which field indicates the type of protocol encapsulated in the payload?

   • AEtherType
   • BSource MAC address
   • CPreamble
   • DFrame Check Sequence (FCS)
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are analyzing a pcap and see an IP packet with the DF (Don't Fragment) flag set and a total length of 4000 bytes. The packet is destined for a host on a network with an MTU of 1500 bytes. What will happen when this packet is forwarded?

   • AThe router will forward the packet as-is, and the destination host will reassemble it.
   • BThe router will drop the packet and send an ICMP Fragmentation Needed message.
   • CThe router will clear the DF flag and fragment the packet.
   • DThe router will fragment the packet into three fragments.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are crafting a UDP packet to test a firewall rule. You set the source IP, destination IP, source port, destination port, and payload. You compute the UDP checksum and set the field. When you send the packet, the firewall drops it. You verify the packet is well-formed. What is the most likely reason the firewall dropped it?

   • AThe IP total length field is correct, but the UDP checksum is optional for IPv4.
   • BThe source port is set to 0, which is not allowed for UDP.
   • CThe UDP length field is set to the payload length instead of the total datagram length.
   • DThe UDP checksum is incorrect because you did not include the pseudo-header in the calculation.
   Reveal Solution Discussion Select an answer first