A network analyst sees a series of IP fragments with the same source, destination, and identification field, but the fragment offsets are not in ascending order. The first fragment received has offset 0 and the last has the More Fragments (MF) bit cleared. What is the most appropriate conclusion and next step?

The fragments are malformed because the MF bit is cleared on the last fragment received, not the first.

The fragments are out of order; the receiving host will reassemble them correctly because IP reassembly is offset-based.

The fragments indicate a fragmentation attack; drop all fragments from that source.

The fragments are duplicates; compare payload contents to identify the correct set.

Which traffic pattern in a packet capture is commonly associated with a port scan?

A steady stream of UDP packets to a single port

A series of TCP SYN packets to multiple ports on a single host

A single large file transfer over HTTP

Periodic DNS queries to a known server

GIAC Certified Intrusion Analyst

Domain 4Objective 1

Packet Engineering GCIA Practice Questions (Page 5)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 21–25

21expert · hard
A network analyst sees a series of IP fragments with the same source, destination, and identification field, but the fragment offsets are not in ascending order. The first fragment received has offset 0 and the last has the More Fragments (MF) bit cleared. What is the most appropriate conclusion and next step?
Select an answer first
22foundation · easy
Which traffic pattern in a packet capture is commonly associated with a port scan?
Select an answer first
23foundation · easy
Which protocol data unit (PDU) is associated with the network layer in the TCP/IP model?
Select an answer first
24foundation · easy
Which field in the IPv4 header is used to prevent a packet from looping indefinitely?
Select an answer first
25foundation · easy
Which TCP flag is used to gracefully terminate a connection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Packet Engineering GCIA Practice Questions (Page 5)

Questions 21–25

Which traffic pattern in a packet capture is commonly associated with a port scan?

Which protocol data unit (PDU) is associated with the network layer in the TCP/IP model?

Which field in the IPv4 header is used to prevent a packet from looping indefinitely?

Which TCP flag is used to gracefully terminate a connection?

Keep studying — Packet Analysis and Engineering