An analyst is examining a TCP packet and notes the following header fields: source port 12345, destination port 80, sequence number 1000, acknowledgment number 0, window size 65535, and flags set to 0x002. What is the most likely purpose of this packet?

It is an ACK packet confirming receipt of data from the server.

It is a RST packet resetting an existing connection.

It is a FIN packet initiating connection termination.

It is the initial SYN packet from a client attempting to open a connection to a web server.

GIAC Certified Intrusion Analyst

Domain 1Objective 4

TCP GCIA Practice Questions (Page 8)

Part of the Network Fundamentals domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~33–56 in this domain), expect 7–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

12concepts

Questions 36–40

36application · medium
A security analyst observes a TCP conversation where the client sends a segment with the FIN flag set, and the server responds with an ACK. The server then sends its own FIN, and the client replies with an ACK. Which TCP state will the client enter after sending that final ACK?
Select an answer first
37application · medium
A security analyst captures a TCP handshake between a client and a server. The client sends a SYN with initial sequence number (ISN) 1000. The server responds with SYN-ACK, acknowledging the client's ISN and advertising its own ISN of 5000. The client then sends an ACK. What acknowledgment number should the client place in that final ACK packet?
Select an answer first
38expert · hard
A TCP sender is in slow start with a congestion window (cwnd) of 4 segments. It receives an ACK for each segment. After receiving all four ACKs, what is the new cwnd?
Select an answer first
39application · medium
An analyst is examining a TCP packet and notes the following header fields: source port 12345, destination port 80, sequence number 1000, acknowledgment number 0, window size 65535, and flags set to 0x002. What is the most likely purpose of this packet?
Select an answer first
40foundation · easy
Which TCP state is entered by the side that initiates connection termination after sending a FIN?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

TCP GCIA Practice Questions (Page 8)

Questions 36–40

A security analyst observes a TCP conversation where the client sends a segment with the FIN flag set, and the server responds with an ACK. The server then sends its own FIN, and the client replies with an ACK. Which TCP state will the client enter after sending that final ACK?

A TCP sender is in slow start with a congestion window (cwnd) of 4 segments. It receives an ACK for each segment. After receiving all four ACKs, what is the new cwnd?

An analyst is examining a TCP packet and notes the following header fields: source port 12345, destination port 80, sequence number 1000, acknowledgment number 0, window size 65535, and flags set to 0x002. What is the most likely purpose of this packet?

Which TCP state is entered by the side that initiates connection termination after sending a FIN?

Keep studying — Network Fundamentals