UDP and ICMP GCIA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   While reviewing a packet capture from a DNS server, an analyst sees a UDP packet with source port 53, destination port 5353, length field 78, and a checksum value. The analyst notes that the UDP length field is 78, but the IP total length field for the same packet is 98. What is the most likely explanation for this difference?

   • AThe IP total length includes the 20-byte IP header, so the UDP length of 78 is correct for the UDP datagram.
   • BThe UDP length field is calculated from the IP total length minus the IP options, so 98 minus 20 equals 78.
   • CThe packet is fragmented, and the UDP length field only reflects the first fragment's payload.
   • DThe UDP checksum is invalid, causing the length field to be reported incorrectly by the capture tool.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network engineer is using ping to test connectivity to a remote host. The ping command sends ICMP Echo Request packets and receives Echo Reply packets. What information does the identifier field in the ICMP header provide?

   • AIt matches Echo Requests with their corresponding Echo Replies.
   • BIt contains the payload data of the ping packet.
   • CIt specifies the TTL value for the packet.
   • DIt indicates the type of ICMP message being sent.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network analyst is reviewing a packet capture from a VoIP call that is experiencing choppy audio. The capture shows a steady stream of UDP packets between the two endpoints, each with a UDP length field of 214 bytes. The analyst notices that some packets are missing from the sequence. Which characteristic of UDP best explains why the call continues despite the missing packets?

   • AUDP is connectionless and does not retransmit lost segments, so the application tolerates the loss.
   • BUDP checksums ensure that missing packets are reconstructed from the payload.
   • CUDP uses sequence numbers to reorder packets, so the missing packets are simply reordered.
   • DUDP automatically retransmits lost packets after a timeout, but the delay is imperceptible.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A network administrator is configuring a firewall and wants to allow ICMP Echo Request and Echo Reply messages for troubleshooting, but block other ICMP types. Which ICMP types should be permitted?

   • AType 8 and Type 0
   • BType 3 and Type 11
   • CType 5 and Type 9
   • DType 13 and Type 14
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network engineer is using a tool that sends ICMP Timestamp Request messages to measure network latency. What is the purpose of the Timestamp Request message?

   • ATo test the reachability of a remote host.
   • BTo request the current time from a remote host.
   • CTo report an error in IP delivery.
   • DTo discover the MTU of the path.
   Reveal Solution Discussion Select an answer first