UDP and ICMP GCIA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A packet capture shows a large number of ICMP echo requests sent to a single host from many different source IP addresses. What does this pattern most likely indicate?

   • AA ping sweep or network scan
   • BA broadcast storm
   • CA routing loop
   • DA normal DNS query pattern
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   An analyst is reviewing a packet capture and sees a UDP packet with source port 68 and destination port 67. What is this packet?

   • AA TFTP read request from a client.
   • BA DHCP request from a client to a server.
   • CA DNS query from a client to a server.
   • DAn NTP synchronization request.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Under which condition does a router generate an ICMP error message?

   • AWhen it receives a packet with a broadcast destination address
   • BWhen it cannot forward a packet due to a routing problem
   • CWhen it successfully forwards a packet to the next hop
   • DWhen it receives a packet with a checksum error
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A network analyst is examining a packet capture and sees an ICMP message with type 3 and code 1. What is the meaning of this message?

   • ADestination Port Unreachable
   • BDestination Host Unreachable
   • CFragmentation Needed and DF Set
   • DDestination Network Unreachable
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing a packet capture and sees a large number of UDP packets from a single source IP to a single destination IP on port 53. The packets are all the same size and are sent at a constant rate. The analyst suspects a DNS amplification attack. What characteristic of UDP makes this attack possible?

   • AUDP does not support checksums, so corrupted packets are not detected.
   • BUDP uses a three-way handshake, which allows the attacker to establish many connections quickly.
   • CUDP is connectionless, so the source IP can be spoofed and the attacker can direct responses to a victim.
   • DUDP has a small header, allowing more packets to be sent per second.
   Reveal Solution Discussion Select an answer first