In TCP congestion avoidance, how does the congestion window typically grow after the slow start threshold is reached?

It increases linearly, typically by one segment per round-trip time.

It doubles every round-trip time.

It remains constant until a loss occurs.

It resets to the initial window size.

A security analyst is examining a packet capture and sees a TCP connection from client IP 10.0.0.5:49152 to server IP 203.0.113.10:443. What does the port number 49152 represent?

A well-known destination port for HTTPS

A registered port used for a specific application

An ephemeral source port chosen by the client for this connection

The server's listening port for secure web traffic

A security analyst is investigating a suspicious TCP connection. The capture shows a SYN packet from a client, followed by a SYN-ACK from the server, but then the client sends a RST instead of an ACK. What is the most likely explanation for this behavior?

The client's TCP stack is malfunctioning and cannot process the SYN-ACK.

The server is not listening on the port, so it sends a RST.

The server's SYN-ACK was lost, so the client resets the connection.

The client is performing a TCP port scan and does not want to complete the handshake.

What is the primary goal of TCP's slow start algorithm?

To prioritize urgent data over normal data

To immediately send the maximum window size to utilize bandwidth

To gradually increase the sending rate until a loss is detected, avoiding congestion

To reduce the window size to zero when idle

GIAC Certified Intrusion Analyst

Domain 1Objective 4

TCP GCIA Practice Questions (Page 3)

Part of the Network Fundamentals domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~33–56 in this domain), expect 7–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

12concepts

Questions 11–15

11foundation · easy
In TCP congestion avoidance, how does the congestion window typically grow after the slow start threshold is reached?
Select an answer first
12foundation · easy
Which packet completes the TCP three-way handshake and confirms that both sides are ready to exchange data?
Select an answer first
13application · medium
A security analyst is examining a packet capture and sees a TCP connection from client IP 10.0.0.5:49152 to server IP 203.0.113.10:443. What does the port number 49152 represent?
Select an answer first
14expert · hard
A security analyst is investigating a suspicious TCP connection. The capture shows a SYN packet from a client, followed by a SYN-ACK from the server, but then the client sends a RST instead of an ACK. What is the most likely explanation for this behavior?
Select an answer first
15foundation · easy
What is the primary goal of TCP's slow start algorithm?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.