You are analyzing a pcap and see a TCP connection with the following packets: 1) SYN, 2) SYN-ACK, 3) ACK, 4) PSH-ACK with data, 5) ACK, 6) FIN, 7) ACK, 8) FIN, 9) ACK. The sequence numbers are consistent. Which statement best describes this traffic?

The connection is experiencing retransmissions because of the repeated ACKs.

The connection was established and terminated normally.

The connection is half-open because only one side sent a FIN.

The connection was reset because a FIN was sent before all data was acknowledged.

GIAC Certified Intrusion Analyst

Domain 4Objective 1

Packet Engineering GCIA Practice Questions (Page 4)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 16–20

16foundation · easy
Which protocol's checksum is optional in IPv4?
Select an answer first
17foundation · easy
In the context of network communication, which layer of the OSI model is primarily responsible for providing end-to-end communication and error recovery between two hosts?
Select an answer first
18application · medium
You are analyzing a pcap and see a TCP connection with the following packets: 1) SYN, 2) SYN-ACK, 3) ACK, 4) PSH-ACK with data, 5) ACK, 6) FIN, 7) ACK, 8) FIN, 9) ACK. The sequence numbers are consistent. Which statement best describes this traffic?
Select an answer first
19foundation · easy
Which tool is commonly used to craft and send custom packets with specific header values and payloads for network testing?
Select an answer first
20foundation · easy
Which flag in the IPv4 header indicates that a packet should not be fragmented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Packet Engineering GCIA Practice Questions (Page 4)

Questions 16–20

Which protocol's checksum is optional in IPv4?

In the context of network communication, which layer of the OSI model is primarily responsible for providing end-to-end communication and error recovery between two hosts?

You are analyzing a pcap and see a TCP connection with the following packets: 1) SYN, 2) SYN-ACK, 3) ACK, 4) PSH-ACK with data, 5) ACK, 6) FIN, 7) ACK, 8) FIN, 9) ACK. The sequence numbers are consistent. Which statement best describes this traffic?

Which tool is commonly used to craft and send custom packets with specific header values and payloads for network testing?

Which flag in the IPv4 header indicates that a packet should not be fragmented?

Keep studying — Packet Analysis and Engineering