GIAC Certified Intrusion Analyst
Domain 1Objective 4
TCP GCIA Practice Questions (Page 7)
Part of the Network Fundamentals domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~33–56 in this domain), expect 7–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)
50questions here
10free pages
12concepts
Questions 31–35
- 31
A TCP connection is in the congestion avoidance phase with a congestion window (cwnd) of 32 segments. The sender receives three duplicate ACKs. After fast retransmit and fast recovery, what is the new congestion window (assuming standard TCP Reno behavior)?
Select an answer first - 32
A security analyst is investigating a suspicious TCP session. The client sends a SYN with ISN 1000. The server responds with SYN-ACK with ISN 5000 and acknowledgment number 1001. The client then sends an ACK with acknowledgment number 5001. Later, the client sends a data segment with sequence number 1001 and payload length 100 bytes. What acknowledgment number should the server send in response to that data segment?
Select an answer first - 33
Which TCP flag is used to abort a connection immediately, typically in response to an error or an unwanted connection attempt?
Select an answer first - 34
What is the range of well-known TCP port numbers?
Select an answer first - 35
A software developer is designing a real-time video conferencing application that must tolerate some packet loss but requires low latency. The application does not need ordered delivery or retransmission of lost packets. Which transport protocol should the developer choose?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.