A security analyst is reviewing a packet capture of a mobile device's traffic. The analyst sees a TLS connection to a known malicious server, but the traffic is encrypted. The analyst wants to determine if the device is communicating with the malicious server or if the traffic is a false positive. Which action would be most effective?

Decrypt the traffic using the server's private key

Ignore the traffic because it is encrypted

Compare the TLS certificate presented by the server with known malicious certificates

Which of the following is a common indicator of encrypted tunneling used for data exfiltration?

The use of port 443, which is commonly used for HTTPS.

A large volume of TLS traffic to a single destination that was not previously observed.

The presence of a valid certificate from a trusted CA.

The use of TLS 1.3, which is more secure than older versions.

During a forensic investigation, an analyst needs to decrypt a mobile device's TLS traffic that was captured earlier. The analyst has physical access to the device and knows the device passcode. Which method would be most appropriate to obtain the TLS session keys?

Perform a brute-force attack on the TLS session key

Use a jailbreak/root tool to extract the SSL key log from the app's process memory

Use a side-channel attack to recover the private key from the server

Request the session keys from the certificate authority

A security analyst is investigating a mobile device that was used to access a corporate email server. The analyst has a full packet capture of the TLS traffic but does not have the device's passcode. The analyst wants to decrypt the email traffic. Which approach is most likely to succeed?

Brute-force the TLS session key

Use a side-channel attack on the device's CPU

Obtain the server's private key and use it to decrypt the session

Request the session keys from the email provider

A security analyst is monitoring a network and sees a mobile device using a VPN tunnel to a remote server. The analyst suspects the device is exfiltrating data through the VPN. The analyst cannot decrypt the VPN traffic. Which detection technique would be most effective?

Ignore the VPN traffic because it is encrypted

Perform a man-in-the-middle attack on the VPN connection

Analyze the volume and timing of the VPN traffic

Block the VPN server's IP address

GIAC Mobile Device Security Analyst

Domain 3Objective 1

Attacking Encrypted Traffic GMOB Practice Questions (Page 10)

Part of the Network Traffic Manipulation and Security domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 46–50

46expert · hard
A security analyst is reviewing a packet capture of a mobile device's traffic. The analyst sees a TLS connection to a known malicious server, but the traffic is encrypted. The analyst wants to determine if the device is communicating with the malicious server or if the traffic is a false positive. Which action would be most effective?
Select an answer first
47foundation · easy
Which of the following is a common indicator of encrypted tunneling used for data exfiltration?
Select an answer first
48application · medium
During a forensic investigation, an analyst needs to decrypt a mobile device's TLS traffic that was captured earlier. The analyst has physical access to the device and knows the device passcode. Which method would be most appropriate to obtain the TLS session keys?
Select an answer first
49expert · hard
A security analyst is investigating a mobile device that was used to access a corporate email server. The analyst has a full packet capture of the TLS traffic but does not have the device's passcode. The analyst wants to decrypt the email traffic. Which approach is most likely to succeed?
Select an answer first
50expert · hard
A security analyst is monitoring a network and sees a mobile device using a VPN tunnel to a remote server. The analyst suspects the device is exfiltrating data through the VPN. The analyst cannot decrypt the VPN traffic. Which detection technique would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.