A user reports that they cannot reach a web server at 192.0.2.10. A packet capture on the user's workstation shows an ICMP Destination Unreachable message with code 3 (Port Unreachable) being returned. What does this ICMP message indicate?

The UDP packet reached the destination host, but no process was listening on the specified UDP port.

The destination host is down and not responding to any traffic.

The packet was dropped because the time-to-live field expired.

The router could not find a route to the destination network.

An analyst is examining a packet capture and sees a UDP packet with a length field of 8 bytes. The source and destination ports are both 12345. What does this indicate?

The packet is a UDP fragment that will be reassembled later.

The packet is an ICMP error message encapsulated in UDP.

The packet is malformed because the length must be at least 20 bytes.

The UDP packet contains no payload data, only the header.

Which scenario is a typical use case for UDP?

Downloading a large file via FTP

A network administrator is designing a system for streaming live video to many clients. The administrator needs to minimize latency and does not require retransmission of lost packets. Which transport protocol should be used?

UDP, because it provides low overhead and no retransmission delays.

TCP, because it guarantees delivery of all video frames.

SCTP, because it is the standard for all streaming media.

ICMP, because it can carry video payloads efficiently.

GIAC Certified Intrusion Analyst

Domain 1Objective 5

UDP and ICMP GCIA Practice Questions (Page 1)

Part of the Network Fundamentals domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~33–56 in this domain), expect 7–11 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 1–5

1foundation · easy
Which ICMP message type is a query message?
Select an answer first
2application · medium
A user reports that they cannot reach a web server at 192.0.2.10. A packet capture on the user's workstation shows an ICMP Destination Unreachable message with code 3 (Port Unreachable) being returned. What does this ICMP message indicate?
Select an answer first
3application · medium
An analyst is examining a packet capture and sees a UDP packet with a length field of 8 bytes. The source and destination ports are both 12345. What does this indicate?
Select an answer first
4foundation · easy
Which scenario is a typical use case for UDP?
Select an answer first
5application · medium
A network administrator is designing a system for streaming live video to many clients. The administrator needs to minimize latency and does not require retransmission of lost packets. Which transport protocol should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.