GIAC Certified Intrusion Analyst
Domain 2Objective 4
Wireshark Fundamentals GCIA Practice Questions (Page 4)
Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)
38questions here
8free pages
8concepts
Questions 16–20
- 16
Which of the following is a valid capture filter that captures only traffic to or from host 192.168.1.10?
Select an answer first - 17
An analyst is investigating a slow network issue. The capture shows many TCP retransmissions and duplicate ACKs. The analyst wants to determine whether the issue is caused by a specific client or server and at what time the problem started. Which combination of statistics tools is most effective?
Select an answer first - 18
An analyst is examining a packet that appears to be malformed. The packet details pane shows an error in the TCP header, and the analyst wants to determine whether this is a single malformed packet or part of a larger pattern. The analyst also wants to see if any other packets in the capture have the same malformed TCP header. What is the most efficient approach?
Select an answer first - 19
Which display filter would show only packets that use TCP port 443?
Select an answer first - 20
An analyst is examining a packet in Wireshark and needs to see the raw hexadecimal representation of the entire Ethernet frame. The analyst also wants to know the source and destination MAC addresses. Which panes should the analyst use?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.