An analyst is investigating a web application that uses HTTPS. The analyst captures a client connection and observes a TLS handshake, but the client sends an HTTP/1.1 request in plaintext after the handshake completes. Which statement best explains this observation?

The client is using HTTP/1.1 over TLS, but the TLS handshake failed, so the request is sent in plaintext.

The analyst is capturing traffic on the server side, where the TLS termination occurs, so the request is decrypted before being logged.

The HTTP request is encrypted by TLS, so the analyst is seeing the decrypted payload because the capture tool has the session keys or the analyst is using a proxy.

The server is configured to accept both HTTP and HTTPS on the same port, so the client falls back to plaintext HTTP.

A network analyst is reviewing a capture of a file transfer from a network device. The capture shows the device sending a read request to a server on UDP port 69, followed by a series of data blocks and acknowledgments. The analyst notices that the transfer is slow because each data block is acknowledged before the next is sent. Which protocol is being used, and what is the primary reason for the slow transfer?

HTTP, which uses a request-response model where each file block is requested individually.

SNMP, which uses UDP and requires an acknowledgment for each management information base (MIB) object transferred.

TFTP, which uses a lockstep stop-and-wait mechanism where each block must be acknowledged before the next is sent.

FTP, which uses a single TCP connection and waits for application-level acknowledgments for each file block.

A security analyst is reviewing a packet capture from a compromised host. The capture shows a DNS query for 'update.contoso.com' followed by a response with an A record pointing to 203.0.113.10. The analyst then sees the host establish a TCP connection to 203.0.113.10 on port 443. What does this sequence indicate?

The host resolved the domain to an IP address and then initiated an HTTPS session to that IP.

The host used DNS to resolve the IP address back to a domain name and then connected to the domain on port 443.

The host used DNS to authenticate the server's certificate before establishing a TLS session.

The host performed a zone transfer to obtain the IP address and then used FTP to transfer data.

GIAC Network Forensic Analyst

Domain 1Objective 1

Common Network Protocols GNFA Practice Questions (Page 10)

Part of the Network Fundamentals and Architecture domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

13concepts

Questions 46–50

46foundation · easy
Which DHCP message is sent by a client to discover available DHCP servers on the network?
Select an answer first
47expert · hard
An analyst is investigating a web application that uses HTTPS. The analyst captures a client connection and observes a TLS handshake, but the client sends an HTTP/1.1 request in plaintext after the handshake completes. Which statement best explains this observation?
Select an answer first
48expert · hard
A network analyst is reviewing a capture of a file transfer from a network device. The capture shows the device sending a read request to a server on UDP port 69, followed by a series of data blocks and acknowledgments. The analyst notices that the transfer is slow because each data block is acknowledged before the next is sent. Which protocol is being used, and what is the primary reason for the slow transfer?
Select an answer first
49application · medium
A security analyst is reviewing a packet capture from a compromised host. The capture shows a DNS query for 'update.contoso.com' followed by a response with an A record pointing to 203.0.113.10. The analyst then sees the host establish a TCP connection to 203.0.113.10 on port 443. What does this sequence indicate?
Select an answer first
50foundation · easy
During a TCP connection establishment, what is the correct sequence of flags exchanged?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Common Network Protocols GNFA Practice Questions (Page 10)

Questions 46–50

Which DHCP message is sent by a client to discover available DHCP servers on the network?

An analyst is investigating a web application that uses HTTPS. The analyst captures a client connection and observes a TLS handshake, but the client sends an HTTP/1.1 request in plaintext after the handshake completes. Which statement best explains this observation?

During a TCP connection establishment, what is the correct sequence of flags exchanged?

Keep studying — Network Fundamentals and Architecture