An analyst is inspecting an HTTP packet and sees the following in the payload: 'GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1'. What should the analyst suspect?

A SQL injection attempt in the query string.

A cross-site scripting (XSS) attack.

What is the correct order of encapsulation when a web browser sends an HTTP request over a TCP/IP network?

IP → Ethernet → TCP → HTTP

Ethernet → IP → TCP → HTTP

HTTP → TCP → IP → Ethernet

TCP → HTTP → IP → Ethernet

An analyst is examining a packet and sees the following headers: Ethernet, IP, TCP, and then a payload that begins with 'SSH-2.0-OpenSSH_7.4'. What is the correct encapsulation order?

SSH encapsulates TCP, TCP encapsulates IP, and IP encapsulates Ethernet.

Ethernet encapsulates TCP, TCP encapsulates IP, and IP encapsulates SSH data.

IP encapsulates Ethernet, Ethernet encapsulates TCP, and TCP encapsulates SSH data.

Ethernet encapsulates IP, IP encapsulates TCP, and TCP encapsulates the SSH protocol data.

A network engineer is troubleshooting packet drops on a router. A packet capture shows an IP packet with a header checksum that does not match the computed value. What is the most likely cause and appropriate action?

The packet is a crafted packet from a scanner; the engineer should block the source IP.

The packet is a fragment and the checksum is only for the first fragment; the router should reassemble it.

The packet was corrupted in transit; the router should drop it and the sender should retransmit.

The checksum is calculated only at the endpoint, so the router should forward the packet.

GIAC Certified Intrusion Analyst

Domain 4Objective 1

Packet Engineering GCIA Practice Questions (Page 3)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 11–15

11application · medium
An analyst is inspecting an HTTP packet and sees the following in the payload: 'GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1'. What should the analyst suspect?
Select an answer first
12foundation · easy
What is the correct order of encapsulation when a web browser sends an HTTP request over a TCP/IP network?
Select an answer first
13foundation · easy
Which checksum is calculated over the entire IPv4 packet, including the header and payload?
Select an answer first
14application · medium
An analyst is examining a packet and sees the following headers: Ethernet, IP, TCP, and then a payload that begins with 'SSH-2.0-OpenSSH_7.4'. What is the correct encapsulation order?
Select an answer first
15application · medium
A network engineer is troubleshooting packet drops on a router. A packet capture shows an IP packet with a header checksum that does not match the computed value. What is the most likely cause and appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.