GIAC Certified Intrusion Analyst
Domain 2Objective 3
Tcpdump Filters GCIA Practice Questions (Page 4)
Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)
20questions here
4free pages
10concepts
Questions 16–20
- 16
An analyst is investigating a potential data exfiltration and needs to capture TCP packets that contain the ASCII string 'SECRET' anywhere in the payload. The analyst is using tcpdump on a Linux system. Which filter expression will match packets containing that string?
Select an answer first - 17
An analyst wants to capture only DNS queries (UDP port 53) from the local network 192.168.1.0/24. Which tcpdump filter is appropriate?
Select an answer first - 18
A malware analyst is examining a pcap file and needs to isolate HTTP requests that contain the string 'admin' in the URI. The analyst knows that the HTTP request line starts at the beginning of the TCP payload. Which tcpdump filter expression, when reading the pcap file, will select packets whose payload contains 'admin' at the start of the payload?
Select an answer first - 19
Which tcpdump filter expression selects all traffic to or from the host 192.168.1.10?
Select an answer first - 20
Which tcpdump filter matches TCP packets with the SYN flag set?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GCIA
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.