GIAC Certified Intrusion Analyst
Domain 4Objective 1
Packet Engineering GCIA Practice Questions (Page 7)
Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)
35questions here
7free pages
10concepts
Questions 31–35
- 31
In a TCP capture, what does a duplicate ACK indicate?
Select an answer first - 32
What does a high number of TCP retransmissions in a capture typically indicate?
Select an answer first - 33
When crafting a TCP SYN packet for a port scan, which flag must be set in the TCP header?
Select an answer first - 34
A packet capture shows an IPv4 packet with the Total Length field set to 1500, the Identification field set to 0x1A2B, and the Fragment Offset field set to 0. The More Fragments (MF) bit is 0. What does this indicate about the packet?
Select an answer first - 35
An analyst sees a TCP handshake where the client sends a SYN with sequence number 1000, the server responds with SYN-ACK with sequence number 5000 and acknowledgment number 1001, and the client sends an ACK with acknowledgment number 5001. What is the next expected sequence number from the client?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GCIA
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.